gh0strat | 95b112301e1d0efe1378ea238a87f823 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

95b112301e1d0efe1378ea238a87f823
Size

102KB
MD5

95b112301e1d0efe1378ea238a87f823
SHA1

58c018b1757c13ef35a37049794d6ad244fae2d3
SHA256

5a57fea9b3229bab2cb562c73b8cd989b87a02045fffd8bb833dd64c67438c27
SHA512

e7cb72136ebb1a6b1c7744980bf5834b730b7b314eda004c0b7637e30c2abb57439e264dc70a4a701c02a09f2ac8d616c0f05259fc3411c8555dca77c704bbaf
SSDEEP

3072:LyvcWBDs/1tJF6IPtWheqGxxQw3KUxT95hNJOU:2vckDszGkWg3mw3KUxx3NJ9

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
95b112301e1d0efe1378ea238a87f823

Files

95b112301e1d0efe1378ea238a87f823
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

ServiceMain
ServicemixX
cervicemixX
svchostdkx

Sections

.text
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Csoop
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE