gh0strat | c8aca2cec5f3f33ae22cbb839aefa1ddc0faebcdabbb0ca4f4fb8a637dace05c

Sharing

Copy URL Twitter E-mail

General

Target
c8aca2cec5f3f33ae22cbb839aefa1ddc0faebcdabbb0ca4f4fb8a637dace05c
Size 899KB
Sample240108-bfx4zahdgr
SHA256 c8aca2cec5f3f33ae22cbb839aefa1ddc0faebcdabbb0ca4f4fb8a637dace05c
MD5 b7571620fa15053529384bd55e6d843e
SHA1 1d545f2b0dc516ad88b3a4b83a5906c55b65f148
SHA512 60c23a9d6c5499ef6cce508c322f77270f354d965f486d4e2103d770464984b7b9c80607ae1eba14657c3ad1f93e3543d7b9e3216cfed0f2fe3da22e917618b0
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXV:7wqd87VV
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c8aca2cec5f3f33ae22cbb839aefa1ddc0faebcdabbb0ca4f4fb8a637dace05c

File Explorer

c8aca2cec5f3f33ae22cbb839aefa1ddc0faebcdabbb0ca4f4fb8a637dace05c

.dll 899KB

c8aca2cec5f3f33ae22cbb839aefa1ddc0faebcdabbb0ca4f4fb8a637dace05c

IMPHASH ae118f3d7fe149b456ac30484c6830f8
SHA256 c8aca2cec5f3f33ae22cbb839aefa1ddc0faebcdabbb0ca4f4fb8a637dace05c
MD5 b7571620fa15053529384bd55e6d843e
SHA1 1d545f2b0dc516ad88b3a4b83a5906c55b65f148
SHA512 60c23a9d6c5499ef6cce508c322f77270f354d965f486d4e2103d770464984b7b9c80607ae1eba14657c3ad1f93e3543d7b9e3216cfed0f2fe3da22e917618b0
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXV:7wqd87VV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Gh0st RAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

54981

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

FindClose LocalFree FindNextFileA LocalReAlloc LocalAlloc FindFirstFileA RemoveDirectoryA SetFileAttributesA ReadFile MoveFileA WaitForSingleObject FreeLibrary GetProcAddress LoadLibraryA GetTickCount WinExec LocalSize GetCurrentProcessId Process32Next TerminateProcess OpenProcess Process32First CopyFileA GetModuleFileNameA GlobalMemoryStatusEx GetCurrentDirectoryA FreeConsole GetModuleHandleA SetEvent GetLogicalDriveStringsA GetProcessHeap VirtualProtect HeapFree InitializeCriticalSection DeleteCriticalSection CreateThread LeaveCriticalSection EnterCriticalSection GlobalFree GlobalUnlock GlobalLock GlobalAlloc GlobalSize QueryPerformanceFrequency QueryPerformanceCounter GetSystemDirectoryA GetStartupInfoA CreatePipe DisconnectNamedPipe TerminateThread PeekNamedPipe WaitForMultipleObjects CreateEventA WritePrivateProfileStringA GetPrivateProfileStringA lstrcmpiA GetCurrentThreadId GetSystemInfo GetVolumeInformationA GetDiskFreeSpaceExA GetDriveTypeA ExpandEnvironmentStringsA lstrcatA CreateProcessA lstrlenA lstrcpyA GetFileAttributesA CreateDirectoryA GetLastError DeleteFileA GetCurrentProcess IsWow64Process GetFileSize CreateFileA SetFilePointer WriteFile VirtualFree CloseHandle Sleep InterlockedExchange VirtualAlloc HeapAlloc

user32

GetUserObjectInformationA GetThreadDesktop wsprintfA SetThreadDesktop CloseDesktop GetCursorPos GetCursorInfo GetClipboardData OpenClipboard EmptyClipboard SetClipboardData CloseClipboard mouse_event MapVirtualKeyA keybd_event CharNextA SystemParametersInfoA SendMessageA ReleaseDC BlockInput DestroyCursor LoadCursorA GetDC GetLastInputInfo OpenInputDesktop GetSystemMetrics ChangeDisplaySettingsA GetWindowThreadProcessId

gdi32

CreateCompatibleBitmap GetDIBits CreateRectRgnIndirect CombineRgn GetRegionData BitBlt DeleteObject CreateCompatibleDC CreateDIBSection SelectObject DeleteDC GetDeviceCaps

advapi32

OpenServiceA QueryServiceStatus ControlService CloseServiceHandle RegQueryValueA RegOpenKeyExA RegSetValueExA RegCloseKey GetUserNameA OpenSCManagerA

shell32

SHGetFolderPathA ShellExecuteExA SHGetFileInfoA SHGetSpecialFolderPathA

ole32

CoCreateInstance CoInitialize

oleaut32

VariantClear VariantInit

mfc42

ord823 ord825

msvcrt

_strupr _stricmp _strcmpi _strnicmp exit fprintf sscanf getenv _adjust_fdiv _initterm _onexit __dllonexit ??1type_info@@UAE@XZ _beginthreadex _iob _errno realloc strchr wcstombs vsprintf sprintf ceil _ftol __CxxFrameHandler _CxxThrowException free malloc _except_handler3 strstr strncpy strrchr memmove _local_unwind2 rand printf atoi strcspn

urlmon

URLDownloadToFileA

ws2_32

inet_ntoa recv send select __WSAFDIsSet recvfrom sendto gethostbyname connect inet_addr WSAStartup WSACleanup accept socket htons bind listen getsockname ntohs closesocket getpeername

msvcp60

?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z ?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?_Xran@std@@YAXXZ ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB

iphlpapi

GetAdaptersInfo GetIfTable

Name

.text

Size

460KB

Virtual Size

460KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rodata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rotext

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

244KB

Virtual Size

244KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

48KB

Virtual Size

472KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

c8aca2cec5f3f33ae22cbb839aefa1ddc0faebcdabbb0ca4f4fb8a637dace05c

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

mfc42

msvcrt

urlmon

ws2_32

msvcp60

iphlpapi

generic