DllUpdate
Install
MainThread
ServiceMain
Uninstall
Resubmissions
04-05-2024 23:26
240504-3e33dafb5w 10General
-
Target
67b026affb29929103b358737c9ef84f9a274e8de04947f9de61a3b31e1bbb56
-
Size
899KB
-
MD5
bdee1e4440bbf427c4321a213cae260e
-
SHA1
940734c33d7641c0787a7d2013619c9665c14038
-
SHA256
67b026affb29929103b358737c9ef84f9a274e8de04947f9de61a3b31e1bbb56
-
SHA512
0a04865e499b5e651217e8a584203d979a5749bc19cc5a2fc075d255b52e6c684367eacd0799b22967e9e338d29685a78545c1f93d269c417f741c7fc25a6ed9
-
SSDEEP
24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXX:7wqd87VX
Score
10/10
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 67b026affb29929103b358737c9ef84f9a274e8de04947f9de61a3b31e1bbb56
Files
-
67b026affb29929103b358737c9ef84f9a274e8de04947f9de61a3b31e1bbb56.dll windows:4 windows x86 arch:x86
ae118f3d7fe149b456ac30484c6830f8
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
FindClose
LocalFree
FindNextFileA
LocalReAlloc
LocalAlloc
FindFirstFileA
RemoveDirectoryA
SetFileAttributesA
ReadFile
MoveFileA
WaitForSingleObject
FreeLibrary
GetProcAddress
LoadLibraryA
GetTickCount
WinExec
LocalSize
GetCurrentProcessId
Process32Next
TerminateProcess
OpenProcess
Process32First
CopyFileA
GetModuleFileNameA
GlobalMemoryStatusEx
GetCurrentDirectoryA
FreeConsole
GetModuleHandleA
SetEvent
GetLogicalDriveStringsA
GetProcessHeap
VirtualProtect
HeapFree
InitializeCriticalSection
DeleteCriticalSection
CreateThread
LeaveCriticalSection
EnterCriticalSection
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
QueryPerformanceFrequency
QueryPerformanceCounter
GetSystemDirectoryA
GetStartupInfoA
CreatePipe
DisconnectNamedPipe
TerminateThread
PeekNamedPipe
WaitForMultipleObjects
CreateEventA
WritePrivateProfileStringA
GetPrivateProfileStringA
lstrcmpiA
GetCurrentThreadId
GetSystemInfo
GetVolumeInformationA
GetDiskFreeSpaceExA
GetDriveTypeA
ExpandEnvironmentStringsA
lstrcatA
CreateProcessA
lstrlenA
lstrcpyA
GetFileAttributesA
CreateDirectoryA
GetLastError
DeleteFileA
GetCurrentProcess
IsWow64Process
GetFileSize
CreateFileA
SetFilePointer
WriteFile
VirtualFree
CloseHandle
Sleep
InterlockedExchange
VirtualAlloc
HeapAlloc
user32
GetUserObjectInformationA
GetThreadDesktop
wsprintfA
SetThreadDesktop
CloseDesktop
GetCursorPos
GetCursorInfo
GetClipboardData
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
mouse_event
MapVirtualKeyA
keybd_event
CharNextA
SystemParametersInfoA
SendMessageA
ReleaseDC
BlockInput
DestroyCursor
LoadCursorA
GetDC
GetLastInputInfo
OpenInputDesktop
GetSystemMetrics
ChangeDisplaySettingsA
GetWindowThreadProcessId
gdi32
CreateCompatibleBitmap
GetDIBits
CreateRectRgnIndirect
CombineRgn
GetRegionData
BitBlt
DeleteObject
CreateCompatibleDC
CreateDIBSection
SelectObject
DeleteDC
GetDeviceCaps
advapi32
OpenServiceA
QueryServiceStatus
ControlService
CloseServiceHandle
RegQueryValueA
RegOpenKeyExA
RegSetValueExA
RegCloseKey
GetUserNameA
OpenSCManagerA
shell32
SHGetFolderPathA
ShellExecuteExA
SHGetFileInfoA
SHGetSpecialFolderPathA
ole32
CoCreateInstance
CoInitialize
oleaut32
VariantClear
VariantInit
mfc42
ord823
ord825
msvcrt
_strupr
_stricmp
_strcmpi
_strnicmp
exit
fprintf
sscanf
getenv
_adjust_fdiv
_initterm
_onexit
__dllonexit
??1type_info@@UAE@XZ
_beginthreadex
_iob
_errno
realloc
strchr
wcstombs
vsprintf
sprintf
ceil
_ftol
__CxxFrameHandler
_CxxThrowException
free
malloc
_except_handler3
strstr
strncpy
strrchr
memmove
_local_unwind2
rand
printf
atoi
strcspn
urlmon
URLDownloadToFileA
ws2_32
inet_ntoa
recv
send
select
__WSAFDIsSet
recvfrom
sendto
gethostbyname
connect
inet_addr
WSAStartup
WSACleanup
accept
socket
htons
bind
listen
getsockname
ntohs
closesocket
getpeername
msvcp60
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Xran@std@@YAXXZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
iphlpapi
GetAdaptersInfo
GetIfTable
Exports
Exports
Sections
.text Size: 460KB - Virtual size: 460KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rodata Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rotext Size: 108KB - Virtual size: 107KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 244KB - Virtual size: 244KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 48KB - Virtual size: 472KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 22KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ