gh0strat | 28c558afa8e9dc73923eab6b08ae99d0_NeikiAnalytics

Sharing

Copy URL Twitter E-mail

General

Target
28c558afa8e9dc73923eab6b08ae99d0_NeikiAnalytics
Size 51KB
Sample240510-agf2eafb7y
SHA256 4f7ecaa65518352fd893fa3930c93c92e57066a94bddaffba22754f1ad05d5d1
MD5 28c558afa8e9dc73923eab6b08ae99d0
SHA1 c80e8a8af5b8c0c3cfbc8f7c1e9a9d52c677ad0d
SHA512 e8714aeb70a59f21a4ef513f8197b56396ea1e31b0e396c0956889795434265fb2d7cb11fc29d55cee8d980b9eb363d79fc4e5a11cc212d8bf1897492a359fed
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL2JYH5:1dWubF3n9S91BF3fboSJYH5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
28c558afa8e9dc73923eab6b08ae99d0_NeikiAnalytics

File Explorer

28c558afa8e9dc73923eab6b08ae99d0_NeikiAnalytics

.dll 51KB

28c558afa8e9dc73923eab6b08ae99d0_NeikiAnalytics

IMPHASH 4847c8aea5b26a115e9f4b1fffee02d5
SHA256 4f7ecaa65518352fd893fa3930c93c92e57066a94bddaffba22754f1ad05d5d1
MD5 28c558afa8e9dc73923eab6b08ae99d0
SHA1 c80e8a8af5b8c0c3cfbc8f7c1e9a9d52c677ad0d
SHA512 e8714aeb70a59f21a4ef513f8197b56396ea1e31b0e396c0956889795434265fb2d7cb11fc29d55cee8d980b9eb363d79fc4e5a11cc212d8bf1897492a359fed
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL2JYH5:1dWubF3n9S91BF3fboSJYH5
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Gh0st RAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

38440

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

lstrlenA lstrcpyA FreeLibrary GetProcAddress LoadLibraryA GetTickCount WinExec ReadFile GetFileAttributesA LocalFree LocalSize LocalAlloc lstrcatA GetCurrentProcessId Process32Next TerminateProcess OpenProcess Process32First CopyFileA GetModuleFileNameA GetLastError WaitForSingleObject CreateProcessA GetCurrentDirectoryA FreeConsole GetModuleHandleA HeapAlloc GetProcessHeap VirtualProtect HeapFree InitializeCriticalSection DeleteCriticalSection CreateThread LeaveCriticalSection EnterCriticalSection SetEvent CreateEventA WritePrivateProfileStringA GetSystemDirectoryA GetPrivateProfileStringA lstrcmpiA GetFileSize CreateFileA SetFilePointer WriteFile CloseHandle Sleep InterlockedExchange VirtualAlloc GlobalMemoryStatusEx VirtualFree

user32

GetWindowThreadProcessId GetLastInputInfo wsprintfA ChangeDisplaySettingsA GetSystemMetrics

advapi32

RegQueryValueA RegSetValueExA RegCloseKey CloseServiceHandle ControlService QueryServiceStatus OpenServiceA OpenSCManagerA RegOpenKeyExA

shell32

SHGetSpecialFolderPathA

ole32

CoCreateInstance CoInitialize

oleaut32

VariantClear VariantInit

mfc42

ord825 ord823

msvcrt

_strupr _strcmpi _stricmp _strnicmp _onexit ??1type_info@@UAE@XZ _beginthreadex _errno realloc strchr _adjust_fdiv __dllonexit _initterm ceil _ftol __CxxFrameHandler _CxxThrowException _except_handler3 _local_unwind2 rand strstr strncpy strrchr free malloc printf atoi strcspn wcstombs

urlmon

URLDownloadToFileA

ws2_32

connect inet_addr getsockname WSAStartup WSACleanup closesocket ntohs listen bind socket accept htons gethostbyname sendto recvfrom __WSAFDIsSet select send recv getpeername inet_ntoa

iphlpapi

GetIfTable GetAdaptersInfo