gh0strat | 9682815aca8750e8d99554f7cad707e18e8d7d79be40e8680e64d6f251545002

Sharing

Copy URL Twitter E-mail

General

Target
9682815aca8750e8d99554f7cad707e18e8d7d79be40e8680e64d6f251545002
Size 899KB
Sample240509-mdqsnafd86
SHA256 9682815aca8750e8d99554f7cad707e18e8d7d79be40e8680e64d6f251545002
MD5 9fc90cbb057635879a1f61e3d7e6753b
SHA1 ed80c6091ef1296f81dbb1b55d98705353ae64da
SHA512 f8692f380f658a4cad859b15e4d73c0913f6d8f7d06c375fc8bdb1696eb3ebb4c6a5a462d814d05d85f3b7d58991359cc13691f3c302b7fb2554aff8fcf3f9b1
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXe:7wqd87Ve
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9682815aca8750e8d99554f7cad707e18e8d7d79be40e8680e64d6f251545002

File Explorer

9682815aca8750e8d99554f7cad707e18e8d7d79be40e8680e64d6f251545002

.dll 899KB

9682815aca8750e8d99554f7cad707e18e8d7d79be40e8680e64d6f251545002

IMPHASH ae118f3d7fe149b456ac30484c6830f8
SHA256 9682815aca8750e8d99554f7cad707e18e8d7d79be40e8680e64d6f251545002
MD5 9fc90cbb057635879a1f61e3d7e6753b
SHA1 ed80c6091ef1296f81dbb1b55d98705353ae64da
SHA512 f8692f380f658a4cad859b15e4d73c0913f6d8f7d06c375fc8bdb1696eb3ebb4c6a5a462d814d05d85f3b7d58991359cc13691f3c302b7fb2554aff8fcf3f9b1
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXe:7wqd87Ve
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Gh0st RAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

54981

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

FindClose LocalFree FindNextFileA LocalReAlloc LocalAlloc FindFirstFileA RemoveDirectoryA SetFileAttributesA ReadFile MoveFileA WaitForSingleObject FreeLibrary GetProcAddress LoadLibraryA GetTickCount WinExec LocalSize GetCurrentProcessId Process32Next TerminateProcess OpenProcess Process32First CopyFileA GetModuleFileNameA GlobalMemoryStatusEx GetCurrentDirectoryA FreeConsole GetModuleHandleA SetEvent GetLogicalDriveStringsA GetProcessHeap VirtualProtect HeapFree InitializeCriticalSection DeleteCriticalSection CreateThread LeaveCriticalSection EnterCriticalSection GlobalFree GlobalUnlock GlobalLock GlobalAlloc GlobalSize QueryPerformanceFrequency QueryPerformanceCounter GetSystemDirectoryA GetStartupInfoA CreatePipe DisconnectNamedPipe TerminateThread PeekNamedPipe WaitForMultipleObjects CreateEventA WritePrivateProfileStringA GetPrivateProfileStringA lstrcmpiA GetCurrentThreadId GetSystemInfo GetVolumeInformationA GetDiskFreeSpaceExA GetDriveTypeA ExpandEnvironmentStringsA lstrcatA CreateProcessA lstrlenA lstrcpyA GetFileAttributesA CreateDirectoryA GetLastError DeleteFileA GetCurrentProcess IsWow64Process GetFileSize CreateFileA SetFilePointer WriteFile VirtualFree CloseHandle Sleep InterlockedExchange VirtualAlloc HeapAlloc

user32

GetUserObjectInformationA GetThreadDesktop wsprintfA SetThreadDesktop CloseDesktop GetCursorPos GetCursorInfo GetClipboardData OpenClipboard EmptyClipboard SetClipboardData CloseClipboard mouse_event MapVirtualKeyA keybd_event CharNextA SystemParametersInfoA SendMessageA ReleaseDC BlockInput DestroyCursor LoadCursorA GetDC GetLastInputInfo OpenInputDesktop GetSystemMetrics ChangeDisplaySettingsA GetWindowThreadProcessId

gdi32

CreateCompatibleBitmap GetDIBits CreateRectRgnIndirect CombineRgn GetRegionData BitBlt DeleteObject CreateCompatibleDC CreateDIBSection SelectObject DeleteDC GetDeviceCaps

advapi32

OpenServiceA QueryServiceStatus ControlService CloseServiceHandle RegQueryValueA RegOpenKeyExA RegSetValueExA RegCloseKey GetUserNameA OpenSCManagerA

shell32

SHGetFolderPathA ShellExecuteExA SHGetFileInfoA SHGetSpecialFolderPathA

ole32

CoCreateInstance CoInitialize

oleaut32

VariantClear VariantInit

mfc42

ord823 ord825

msvcrt

_strupr _stricmp _strcmpi _strnicmp exit fprintf sscanf getenv _adjust_fdiv _initterm _onexit __dllonexit ??1type_info@@UAE@XZ _beginthreadex _iob _errno realloc strchr wcstombs vsprintf sprintf ceil _ftol __CxxFrameHandler _CxxThrowException free malloc _except_handler3 strstr strncpy strrchr memmove _local_unwind2 rand printf atoi strcspn

urlmon

URLDownloadToFileA

ws2_32

inet_ntoa recv send select __WSAFDIsSet recvfrom sendto gethostbyname connect inet_addr WSAStartup WSACleanup accept socket htons bind listen getsockname ntohs closesocket getpeername

msvcp60

?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z ?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?_Xran@std@@YAXXZ ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB

iphlpapi

GetAdaptersInfo GetIfTable

Name

.text

Size

460KB

Virtual Size

460KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rodata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rotext

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

244KB

Virtual Size

244KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

48KB

Virtual Size

472KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

9682815aca8750e8d99554f7cad707e18e8d7d79be40e8680e64d6f251545002

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

mfc42

msvcrt

urlmon

ws2_32

msvcp60

iphlpapi

generic