gh0strat | dfe604f3e4ba37dc25a5ce855293bf5f7ce639198d2310534cab43d49be7a17f

Sharing

Copy URL Twitter E-mail

General

Target
dfe604f3e4ba37dc25a5ce855293bf5f7ce639198d2310534cab43d49be7a17f
Size 50KB
Sample240508-wvrkysbb58
SHA256 dfe604f3e4ba37dc25a5ce855293bf5f7ce639198d2310534cab43d49be7a17f
MD5 99c35475a0990589aafdf41d2cc0b099
SHA1 21d6f0424613331a873a1f9245e987d45e4d3984
SHA512 34d4572a6b6ea6f4f7bfa096705e071922c39ff9edc679898a467bec599792c776baa4811136607e3cd22971b445fc8346846dc5af5de7f6bc28c6ab97c9d5b3
SSDEEP 1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o51tJYH:W5ReWjTrW9rNPgYo/tJYH
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dfe604f3e4ba37dc25a5ce855293bf5f7ce639198d2310534cab43d49be7a17f

File Explorer

dfe604f3e4ba37dc25a5ce855293bf5f7ce639198d2310534cab43d49be7a17f

.dll 50KB

dfe604f3e4ba37dc25a5ce855293bf5f7ce639198d2310534cab43d49be7a17f

IMPHASH 4847c8aea5b26a115e9f4b1fffee02d5
SHA256 dfe604f3e4ba37dc25a5ce855293bf5f7ce639198d2310534cab43d49be7a17f
MD5 99c35475a0990589aafdf41d2cc0b099
SHA1 21d6f0424613331a873a1f9245e987d45e4d3984
SHA512 34d4572a6b6ea6f4f7bfa096705e071922c39ff9edc679898a467bec599792c776baa4811136607e3cd22971b445fc8346846dc5af5de7f6bc28c6ab97c9d5b3
SSDEEP 1536:WD1N4TeeWMWfPbp2WTrW9L3JPPgJ+o51tJYH:W5ReWjTrW9rNPgYo/tJYH
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Gh0st RAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

37863

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

lstrlenA lstrcpyA FreeLibrary GetProcAddress LoadLibraryA GetTickCount WinExec ReadFile GetFileAttributesA LocalFree LocalSize LocalAlloc lstrcatA GetCurrentProcessId Process32Next TerminateProcess OpenProcess Process32First CopyFileA GetModuleFileNameA GetLastError WaitForSingleObject CreateProcessA GetCurrentDirectoryA FreeConsole GetModuleHandleA HeapAlloc GetProcessHeap VirtualProtect HeapFree InitializeCriticalSection DeleteCriticalSection CreateThread LeaveCriticalSection EnterCriticalSection SetEvent CreateEventA WritePrivateProfileStringA GetSystemDirectoryA GetPrivateProfileStringA lstrcmpiA GetFileSize CreateFileA SetFilePointer WriteFile CloseHandle Sleep InterlockedExchange VirtualAlloc GlobalMemoryStatusEx VirtualFree

user32

GetWindowThreadProcessId GetLastInputInfo wsprintfA ChangeDisplaySettingsA GetSystemMetrics

advapi32

RegQueryValueA RegSetValueExA RegCloseKey CloseServiceHandle ControlService QueryServiceStatus OpenServiceA OpenSCManagerA RegOpenKeyExA

shell32

SHGetSpecialFolderPathA

ole32

CoCreateInstance CoInitialize

oleaut32

VariantClear VariantInit

mfc42

ord825 ord823

msvcrt

_strupr _strcmpi _stricmp _strnicmp _onexit ??1type_info@@UAE@XZ _beginthreadex _errno realloc strchr _adjust_fdiv __dllonexit _initterm ceil _ftol __CxxFrameHandler _CxxThrowException _except_handler3 _local_unwind2 rand strstr strncpy strrchr free malloc printf atoi strcspn wcstombs

urlmon

URLDownloadToFileA

ws2_32

connect inet_addr getsockname WSAStartup WSACleanup closesocket ntohs listen bind socket accept htons gethostbyname sendto recvfrom __WSAFDIsSet select send recv getpeername inet_ntoa

iphlpapi

GetIfTable GetAdaptersInfo