gh0strat | aad792cba37f9116397075d5dca5c4cc

Sharing

Copy URL

Twitter E-mail

General

Target

aad792cba37f9116397075d5dca5c4cc
Size

194KB
MD5

aad792cba37f9116397075d5dca5c4cc
SHA1

d8df2f4682fad5668643fad761d42d4332569830
SHA256

e79f5cc6819b3aa03e49e64048a9c6eda60739b9b570787a8d39fa7ce593ec34
SHA512

47a899093625e83bc61900108c6deb3b2a76b91a349a771fdf702c3e8f05c90a4228ef05fd8ffb3e9542e530bc1a686a763d86be39d75bbedd9a07befa5bbdd9
SSDEEP

3072:Koi2oyQlBYrU7LvTduSeHbh9T8iYE/rtOfB/jnM/hOv:3ihyQl+UnvTpAhZXP/rtOfB/cI

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aad792cba37f9116397075d5dca5c4cc

Files

aad792cba37f9116397075d5dca5c4cc
.exe windows:4 windows x86 arch:x86

b571a808a90c956ff0b3ded2f637645d

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

HeapFree
GetProcAddress
GetModuleHandleA
HeapAlloc
GetProcessHeap
GetLastError
lstrcatA
CloseHandle
CreateFileA
GetModuleFileNameA
ExitProcess
DeleteFileA
SetFileAttributesA
MoveFileA
FreeResource
lstrlenA
WriteFile
SizeofResource
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
LoadResource
FindResourceA
GetTickCount
GetTempPathA
FreeLibrary
LoadLibraryA
ReadFile
SetFilePointer
lstrcmpiA
SetLastError
lstrcpyA
GetFileAttributesA
lstrcmpA
Sleep
GetWindowsDirectoryA
WideCharToMultiByte
MultiByteToWideChar
SetUnhandledExceptionFilter
ReleaseMutex
WinExec
CreateMutexA
GetCommandLineA
GetCurrentThreadId
GetStartupInfoA
RaiseException
InterlockedExchange
LocalAlloc

msvcrt

__CxxFrameHandler
_CxxThrowException
??3@YAXPAX@Z
??2@YAPAXI@Z
strstr
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
strchr
malloc
realloc
_except_handler3

Sections

.text
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 106KB - Virtual size: 105KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

9527
Size: 216B - Virtual size: 216B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

9527
Size: 45B - Virtual size: 45B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

9527
Size: 89B - Virtual size: 89B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

9527
Size: 113B - Virtual size: 113B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

9527
Size: 139B - Virtual size: 139B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

9527
Size: 59B - Virtual size: 59B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b571a808a90c956ff0b3ded2f637645d

Headers

File Characteristics

Imports

kernel32

msvcrt

Sections

.text Size: 15KB - Virtual size: 15KB

.rsrc Size: 106KB - Virtual size: 105KB

9527 Size: 216B - Virtual size: 216B

9527 Size: 45B - Virtual size: 45B

9527 Size: 89B - Virtual size: 89B

9527 Size: 113B - Virtual size: 113B

9527 Size: 139B - Virtual size: 139B

9527 Size: 59B - Virtual size: 59B

.text
Size: 15KB - Virtual size: 15KB

.rsrc
Size: 106KB - Virtual size: 105KB

9527
Size: 216B - Virtual size: 216B

9527
Size: 45B - Virtual size: 45B

9527
Size: 89B - Virtual size: 89B

9527
Size: 113B - Virtual size: 113B

9527
Size: 139B - Virtual size: 139B

9527
Size: 59B - Virtual size: 59B