gh0strat | 7520b966d72af662b5ff0f04e2d9f44d

Sharing

Copy URL Twitter E-mail

General

Target
7520b966d72af662b5ff0f04e2d9f44d
Size 88KB
Sample240125-wb98yschfp
SHA256 e80a450921acadf87614f81bccf0ef39cd95304719885368776cc77c6e01f8ec
MD5 7520b966d72af662b5ff0f04e2d9f44d
SHA1 5d55692b69236d99e5c396d530b3b17d064d54f8
SHA512 287ed1512c4f8ac09dd0da1ac6bccb5a3bbbcb913eba1c83d9b7266f08692427ba9dc167c27ac02f9ab9f0f2ed0cad3dde94e18c319be22e4083d343755ea3b8
SSDEEP 1536:FPx1BXEVnPdTG8rbWtaYc5Zykfxc8MrBZmTksXz:FPxzUt88WaY+ZyWxc82BZmTksXz
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7520b966d72af662b5ff0f04e2d9f44d

File Explorer

7520b966d72af662b5ff0f04e2d9f44d

.dll 88KB

7520b966d72af662b5ff0f04e2d9f44d

IMPHASH ce583b8389f7c116e45c28b94eb90c68
SHA256 e80a450921acadf87614f81bccf0ef39cd95304719885368776cc77c6e01f8ec
MD5 7520b966d72af662b5ff0f04e2d9f44d
SHA1 5d55692b69236d99e5c396d530b3b17d064d54f8
SHA512 287ed1512c4f8ac09dd0da1ac6bccb5a3bbbcb913eba1c83d9b7266f08692427ba9dc167c27ac02f9ab9f0f2ed0cad3dde94e18c319be22e4083d343755ea3b8
SSDEEP 1536:FPx1BXEVnPdTG8rbWtaYc5Zykfxc8MrBZmTksXz:FPxzUt88WaY+ZyWxc82BZmTksXz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Gh0st RAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

64113

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetFileAttributesA GetTempPathA TerminateThread MoveFileExA GetTickCount GetLocalTime GetModuleHandleA GlobalFree GlobalUnlock GlobalLock GlobalAlloc GlobalSize GetStartupInfoA CreatePipe DisconnectNamedPipe TerminateProcess PeekNamedPipe WaitForMultipleObjects SizeofResource WriteFile GetSystemDirectoryA DeviceIoControl LoadLibraryExA SetFileAttributesA ReleaseMutex OpenEventA SetErrorMode CreateMutexA SetUnhandledExceptionFilter FreeConsole LocalSize OpenProcess Process32Next Process32First CreateToolhelp32Snapshot GetCurrentProcess lstrcmpiA GetCurrentThreadId SetFilePointer ReadFile CreateFileA SetLastError GetLastError FindResourceA MoveFileA GetFileSize RemoveDirectoryA LocalAlloc FindFirstFileA LocalReAlloc FindNextFileA LocalFree FindClose GetLogicalDriveStringsA GetVolumeInformationA GetDiskFreeSpaceExA GetDriveTypeA CreateProcessA DeleteFileA GetVersionExA GetPrivateProfileStringA lstrcmpA WideCharToMultiByte MultiByteToWideChar LoadLibraryA GetProcAddress FreeLibrary GetWindowsDirectoryA lstrcatA GetPrivateProfileSectionNamesA lstrlenA Sleep CancelIo InterlockedExchange SetEvent ResetEvent lstrcpyA WaitForSingleObject CloseHandle CreateEventA VirtualAlloc EnterCriticalSection LeaveCriticalSection VirtualFree DeleteCriticalSection LoadResource InitializeCriticalSection

user32

CreateWindowExA PostMessageA OpenDesktopA GetThreadDesktop OpenInputDesktop SetThreadDesktop CloseDesktop EnumWindows GetWindowThreadProcessId CloseWindow GetProcessWindowStation OpenWindowStationA SetProcessWindowStation CloseWindowStation GetCursorPos ReleaseDC GetDesktopWindow GetDC GetSystemMetrics SetRect GetClipboardData ExitWindowsEx IsWindow IsWindowVisible wsprintfA GetWindowTextA GetActiveWindow GetKeyNameTextA GetFocus CallNextHookEx GetUserObjectInformationA SetWindowsHookExA UnhookWindowsHookEx SystemParametersInfoA SendMessageA keybd_event OpenClipboard EmptyClipboard SetClipboardData CloseClipboard mouse_event SetCursorPos WindowFromPoint SetCapture MapVirtualKeyA

gdi32

GetPaletteEntries SelectObject DeleteObject DeleteDC BitBlt CreateHalftonePalette CreateCompatibleDC CreateDIBSection

advapi32

GetTokenInformation LookupAccountSidA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges SetServiceStatus RegisterServiceCtrlHandlerExA StartServiceA IsValidSid LookupAccountNameA LsaClose LsaRetrievePrivateData LsaOpenPolicy LsaFreeMemory RegCloseKey RegQueryValueA RegOpenKeyExA CloseServiceHandle DeleteService ControlService QueryServiceStatus OpenServiceA OpenSCManagerA RegSetValueExA RegCreateKeyA RegQueryValueExA RegOpenKeyA CloseEventLog ClearEventLogA OpenEventLogA

shell32

SHGetFileInfoA SHGetSpecialFolderPathA

shlwapi

SHDeleteKeyA

msvcrt

_except_handler3 strncpy realloc atoi wcstombs _beginthreadex strrchr free ??1type_info@@UAE@XZ _initterm _adjust_fdiv malloc strchr _CxxThrowException _strcmpi ??2@YAPAXI@Z __CxxFrameHandler strstr _ftol ceil memmove calloc ??3@YAXPAX@Z

ws2_32

gethostbyname send socket gethostname getsockname setsockopt connect WSAStartup WSACleanup select closesocket recv ntohs htons

msvcp60

?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?_Xran@std@@YAXXZ ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z

dbghelp

MakeSureDirectoryPathExists

imm32

ImmReleaseContext ImmGetContext ImmGetCompositionStringA

wininet

InternetOpenUrlA InternetReadFile InternetCloseHandle InternetOpenA

urlmon

URLDownloadToFileA

avicap32

capGetDriverDescriptionA capCreateCaptureWindowA

psapi

EnumProcessModules GetModuleFileNameExA

wtsapi32

WTSFreeMemory WTSQuerySessionInformationA

Name

.text

Size

59KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.shared

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

7520b966d72af662b5ff0f04e2d9f44d

kernel32

user32

gdi32

advapi32

shell32

shlwapi

msvcrt

ws2_32

msvcp60

dbghelp

imm32

wininet

urlmon

avicap32

psapi

wtsapi32

generic