jz
Behavioral task
behavioral1
Sample
c43a0c18a6575bacb930ab6d076e470bee4877dfb6fe6a8d1b72e579f528dd99.dll
Resource
win7-20240221-en
General
-
Target
c43a0c18a6575bacb930ab6d076e470bee4877dfb6fe6a8d1b72e579f528dd99
-
Size
160KB
-
MD5
9fea68d8b8c8d4f6d38a7905e32fc2ad
-
SHA1
153c9a3b5d58e9d50053cf0dee4a4bb0fd955541
-
SHA256
c43a0c18a6575bacb930ab6d076e470bee4877dfb6fe6a8d1b72e579f528dd99
-
SHA512
cbe50aa0a2b7ef943860d1161337888bfba19fe999a7b01635909e66103dbe3f3df5be033ee35c7169471ed6ec77c0e69e88d59e70586f6d95b12c1f8166af78
-
SSDEEP
3072:A4j1QF83uXAn5HgDr6CAU2tJF3F0tGML9q:A4j108jlIrHAtFrM
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c43a0c18a6575bacb930ab6d076e470bee4877dfb6fe6a8d1b72e579f528dd99
Files
-
c43a0c18a6575bacb930ab6d076e470bee4877dfb6fe6a8d1b72e579f528dd99.dll windows:4 windows x86 arch:x86
a00fca2ba3570d0062ff8ba14a127c1b
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
lstrcmpiA
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSection
HeapFree
VirtualProtect
GetProcessHeap
HeapAlloc
GlobalMemoryStatusEx
GetModuleHandleA
GetLastError
CreateProcessA
GetProcAddress
GetCurrentProcess
FreeLibrary
ReadFile
ExitProcess
GetVersionExA
GetTickCount
WinExec
LocalAlloc
LocalSize
RtlUnwind
RaiseException
HeapReAlloc
GetCurrentThreadId
TlsSetValue
TlsGetValue
ExitThread
LocalFree
GetVersion
TlsAlloc
TlsFree
SetLastError
SetUnhandledExceptionFilter
HeapSize
GetCPInfo
GetACP
GetOEMCP
IsBadWritePtr
GetEnvironmentVariableA
HeapDestroy
HeapCreate
UnhandledExceptionFilter
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
InterlockedDecrement
InterlockedIncrement
IsBadReadPtr
IsBadCodePtr
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetExitCodeProcess
SetStdHandle
FlushFileBuffers
CompareStringA
CompareStringW
SetEnvironmentVariableA
GlobalFree
GlobalUnlock
GlobalHandle
GlobalLock
GlobalReAlloc
GlobalAlloc
LocalReAlloc
lstrcpynA
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
GlobalGetAtomNameA
GetProcessVersion
lstrcmpA
GlobalFlags
GetModuleFileNameA
GetFileAttributesA
CopyFileA
MoveFileExA
CreateDirectoryA
SetFileAttributesA
LoadLibraryA
CreateToolhelp32Snapshot
Process32First
Process32Next
OpenProcess
TerminateProcess
FindFirstFileA
DeleteFileA
FindNextFileA
FindClose
RemoveDirectoryA
lstrcatA
GetLocalTime
GetSystemDirectoryA
CreateFileA
GetFileSize
SetFilePointer
lstrlenA
WriteFile
CreateThread
OutputDebugStringA
lstrcpyA
Sleep
CancelIo
InterlockedExchange
SetEvent
ResetEvent
WaitForSingleObject
CloseHandle
CreateEventA
VirtualAlloc
GetCommandLineA
VirtualFree
user32
GetPropA
SetPropA
GetClassLongA
CreateWindowExA
DestroyWindow
GetDlgCtrlID
GetDlgItem
GetMenuItemID
GetSubMenu
GetMenuItemCount
GetMenu
RegisterClassA
GetClassInfoA
WinHelpA
GetCapture
GetTopWindow
CopyRect
GetClientRect
AdjustWindowRectEx
SetFocus
GetSysColor
MapWindowPoints
PostMessageA
LoadIconA
SetWindowTextA
LoadCursorA
GetSysColorBrush
ReleaseDC
GetDC
PtInRect
ClientToScreen
CallWindowProcA
DestroyMenu
TabbedTextOutA
DrawTextA
GrayStringA
SetWindowLongA
SetWindowPos
RegisterWindowMessageA
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetMenuCheckMarkDimensions
LoadBitmapA
GetMenuState
ModifyMenuA
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
DispatchMessageA
CallNextHookEx
PeekMessageA
SetWindowsHookExA
GetParent
GetLastActivePopup
IsWindowEnabled
GetWindowLongA
SendMessageA
MessageBoxA
EnableWindow
UnhookWindowsHookEx
LoadStringA
RemovePropA
DefWindowProcA
wsprintfA
GetWindowTextA
GetForegroundWindow
GetAsyncKeyState
GetKeyState
GetWindow
GetClassNameA
FindWindowA
ChangeDisplaySettingsA
GetSystemMetrics
GetLastInputInfo
GetMessageTime
GetMessagePos
PostQuitMessage
SetForegroundWindow
advapi32
LockServiceDatabase
UnlockServiceDatabase
StartServiceA
RegOpenKeyA
CloseServiceHandle
StartServiceCtrlDispatcherA
RegQueryValueA
RegisterServiceCtrlHandlerA
SetServiceStatus
OpenProcessToken
DuplicateTokenEx
SetTokenInformation
CreateProcessAsUserA
RegOpenKeyExA
RegSetValueExA
RegCloseKey
OpenSCManagerA
OpenServiceA
DeleteService
OpenEventLogA
ClearEventLogA
CloseEventLog
CreateServiceA
ChangeServiceConfig2A
shell32
ShellExecuteExA
SHGetSpecialFolderPathA
ws2_32
socket
select
recv
closesocket
gethostbyname
htons
connect
setsockopt
WSAStartup
WSACleanup
send
WSAIoctl
comctl32
ord17
urlmon
URLDownloadToFileA
wininet
InternetGetConnectedState
gdi32
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
Escape
ExtTextOutA
TextOutA
RectVisible
PtVisible
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
GetStockObject
SelectObject
RestoreDC
SaveDC
DeleteDC
DeleteObject
GetDeviceCaps
GetObjectA
SetBkColor
SetTextColor
GetClipBox
CreateBitmap
winspool.drv
OpenPrinterA
DocumentPropertiesA
ClosePrinter
Exports
Exports
Sections
.text Size: 96KB - Virtual size: 95KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 24KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 16KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ