gh0strat | a08e0cc79c78f48a08bb32372b1bbe08

Sharing

Copy URL Twitter E-mail

General

Target

a08e0cc79c78f48a08bb32372b1bbe08
Size

34KB
MD5

a08e0cc79c78f48a08bb32372b1bbe08
SHA1

99f5e777cb3eab70f611241d959ac1be4ba2236d
SHA256

a3ff22455a8d8a494c5eb4e4452dbe72004b8828e2827fddefc5e8de3c36b413
SHA512

5e60e69a6f36a062fa61f0e213fcf400bd1817fa5e60b2f0be2d501691827226fa15c3f21818edd93637947aac341d1e791dcf989e5ed6421528b0ad1399842d
SSDEEP

768:t4brB01n8uiwOCb/8+Y2OCPrCvPOs/eB8:/nFiwOx+YATCus/o

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a08e0cc79c78f48a08bb32372b1bbe08

Files

a08e0cc79c78f48a08bb32372b1bbe08
.exe windows:4 windows x86 arch:x86

90c41f57bfd675c8f14c3436948bfa8f

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

LoadLibraryA
lstrcpyA
MoveFileA
GetFileAttributesA
GetSystemDirectoryA
GetWindowsDirectoryA
GetProcAddress
Sleep
ReleaseMutex
GetLastError
CreateMutexA
GetCommandLineA
GetModuleHandleA
GetStartupInfoA
MultiByteToWideChar
SetLastError
lstrlenA
FindResourceA
LoadResource
SizeofResource
WriteFile
GetModuleFileNameA
CreateFileA
WinExec
CloseHandle

user32

wsprintfA

advapi32

QueryServiceConfigA
RegQueryValueExA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
LockServiceDatabase
ChangeServiceConfigA
UnlockServiceDatabase
StartServiceA
RegOpenKeyExA
RegSetValueExA
RegCloseKey

msvcp60

?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Xlen@std@@YAXXZ
?_Xran@std@@YAXXZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ABV12@II@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z

msvcrt

malloc
memmove
memchr
_except_handler3
??2@YAPAXI@Z
strchr
__CxxFrameHandler
_CxxThrowException
fclose
fprintf
fopen
strrchr
strstr
free
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp

Sections

.text
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

90c41f57bfd675c8f14c3436948bfa8f

Headers

File Characteristics

Imports

kernel32

user32

advapi32

msvcp60

msvcrt

Sections

.text Size: 4KB - Virtual size: 3KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 1024B - Virtual size: 1KB

.rsrc Size: 25KB - Virtual size: 25KB

.text
Size: 4KB - Virtual size: 3KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 1024B - Virtual size: 1KB

.rsrc
Size: 25KB - Virtual size: 25KB