gh0strat | e4bad76b1c333714168cf1c7d76c4e60_NEIKI

Sharing

Copy URL Twitter E-mail

General

Target
e4bad76b1c333714168cf1c7d76c4e60_NEIKI
Size 899KB
Sample240508-sgk98sce68
SHA256 74c8ab3eb8241df35ae298e11c66de9b6175cce2c62607c7d0bae071d2367d4d
MD5 e4bad76b1c333714168cf1c7d76c4e60
SHA1 cf2f7917d2d1626780613d32a423ab71643a990d
SHA512 02798a3138c252ef34a29f9b27a0275ebadb6bd3608c32895b7c6d2979a32457ea9aa94ab423bca9303f19e2a99a5e5eaa29838f826e6ae583db8574834768f1
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PX+:7wqd87V+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e4bad76b1c333714168cf1c7d76c4e60_NEIKI

File Explorer

e4bad76b1c333714168cf1c7d76c4e60_NEIKI

.dll 899KB

e4bad76b1c333714168cf1c7d76c4e60_NEIKI

IMPHASH ae118f3d7fe149b456ac30484c6830f8
SHA256 74c8ab3eb8241df35ae298e11c66de9b6175cce2c62607c7d0bae071d2367d4d
MD5 e4bad76b1c333714168cf1c7d76c4e60
SHA1 cf2f7917d2d1626780613d32a423ab71643a990d
SHA512 02798a3138c252ef34a29f9b27a0275ebadb6bd3608c32895b7c6d2979a32457ea9aa94ab423bca9303f19e2a99a5e5eaa29838f826e6ae583db8574834768f1
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PX+:7wqd87V+
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Gh0st RAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

54981

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

FindClose LocalFree FindNextFileA LocalReAlloc LocalAlloc FindFirstFileA RemoveDirectoryA SetFileAttributesA ReadFile MoveFileA WaitForSingleObject FreeLibrary GetProcAddress LoadLibraryA GetTickCount WinExec LocalSize GetCurrentProcessId Process32Next TerminateProcess OpenProcess Process32First CopyFileA GetModuleFileNameA GlobalMemoryStatusEx GetCurrentDirectoryA FreeConsole GetModuleHandleA SetEvent GetLogicalDriveStringsA GetProcessHeap VirtualProtect HeapFree InitializeCriticalSection DeleteCriticalSection CreateThread LeaveCriticalSection EnterCriticalSection GlobalFree GlobalUnlock GlobalLock GlobalAlloc GlobalSize QueryPerformanceFrequency QueryPerformanceCounter GetSystemDirectoryA GetStartupInfoA CreatePipe DisconnectNamedPipe TerminateThread PeekNamedPipe WaitForMultipleObjects CreateEventA WritePrivateProfileStringA GetPrivateProfileStringA lstrcmpiA GetCurrentThreadId GetSystemInfo GetVolumeInformationA GetDiskFreeSpaceExA GetDriveTypeA ExpandEnvironmentStringsA lstrcatA CreateProcessA lstrlenA lstrcpyA GetFileAttributesA CreateDirectoryA GetLastError DeleteFileA GetCurrentProcess IsWow64Process GetFileSize CreateFileA SetFilePointer WriteFile VirtualFree CloseHandle Sleep InterlockedExchange VirtualAlloc HeapAlloc

user32

GetUserObjectInformationA GetThreadDesktop wsprintfA SetThreadDesktop CloseDesktop GetCursorPos GetCursorInfo GetClipboardData OpenClipboard EmptyClipboard SetClipboardData CloseClipboard mouse_event MapVirtualKeyA keybd_event CharNextA SystemParametersInfoA SendMessageA ReleaseDC BlockInput DestroyCursor LoadCursorA GetDC GetLastInputInfo OpenInputDesktop GetSystemMetrics ChangeDisplaySettingsA GetWindowThreadProcessId

gdi32

CreateCompatibleBitmap GetDIBits CreateRectRgnIndirect CombineRgn GetRegionData BitBlt DeleteObject CreateCompatibleDC CreateDIBSection SelectObject DeleteDC GetDeviceCaps

advapi32

OpenServiceA QueryServiceStatus ControlService CloseServiceHandle RegQueryValueA RegOpenKeyExA RegSetValueExA RegCloseKey GetUserNameA OpenSCManagerA

shell32

SHGetFolderPathA ShellExecuteExA SHGetFileInfoA SHGetSpecialFolderPathA

ole32

CoCreateInstance CoInitialize

oleaut32

VariantClear VariantInit

mfc42

ord823 ord825

msvcrt

_strupr _stricmp _strcmpi _strnicmp exit fprintf sscanf getenv _adjust_fdiv _initterm _onexit __dllonexit ??1type_info@@UAE@XZ _beginthreadex _iob _errno realloc strchr wcstombs vsprintf sprintf ceil _ftol __CxxFrameHandler _CxxThrowException free malloc _except_handler3 strstr strncpy strrchr memmove _local_unwind2 rand printf atoi strcspn

urlmon

URLDownloadToFileA

ws2_32

inet_ntoa recv send select __WSAFDIsSet recvfrom sendto gethostbyname connect inet_addr WSAStartup WSACleanup accept socket htons bind listen getsockname ntohs closesocket getpeername

msvcp60

?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z ?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?_Xran@std@@YAXXZ ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB

iphlpapi

GetAdaptersInfo GetIfTable

Name

.text

Size

460KB

Virtual Size

460KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rodata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rotext

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

244KB

Virtual Size

244KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

48KB

Virtual Size

472KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

e4bad76b1c333714168cf1c7d76c4e60_NEIKI

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

mfc42

msvcrt

urlmon

ws2_32

msvcp60

iphlpapi

generic