gh0strat | 0f72e9eb5201b984d8926887694111ed09f28c87261df7aab663f5dc493e215f[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

0f72e9eb5201b984d8926887694111ed09f28c87261df7aab663f5dc493e215f.dll
Size

196KB
MD5

b4f342daa9b2667d133ce22d6fc6997c
SHA1

4cd9fe4576f28595783bd920cbaf890994e21f8c
SHA256

0f72e9eb5201b984d8926887694111ed09f28c87261df7aab663f5dc493e215f
SHA512

0412e972deb5d399d421956de43dc1f37126f06e38a0b0ad223c9761e9080165e879d9569e4e281a5cee8aa1f783777c90b2485f5b7e2a37bd2c4e149c070970
SSDEEP

3072:vXBWbhPRhNADRPmtWYMrv0ctSkM3XeEECxkcHtuXnu:vXBOPRhNAD9wmr8eSRafXu

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0f72e9eb5201b984d8926887694111ed09f28c87261df7aab663f5dc493e215f.dll

Files

0f72e9eb5201b984d8926887694111ed09f28c87261df7aab663f5dc493e215f.dll
.dll windows:4 windows x86 arch:x86

4ffa3338ea9c6142fb4ff98513e5c47d

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcmpiW
lstrcmpW
GlobalFlags
FlushFileBuffers
RtlUnwind
RaiseException
GetTimeZoneInformation
GetSystemTime
HeapReAlloc
ExitThread
GetCommandLineA
HeapSize
GetProcessVersion
TerminateProcess
IsBadWritePtr
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
UnhandledExceptionFilter
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
LCMapStringA
LCMapStringW
IsBadCodePtr
GetCPInfo
GetOEMCP
GetStringTypeA
GetStringTypeW
CompareStringA
CompareStringW
SetEnvironmentVariableA
GetModuleHandleA
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
GetVersion
TlsGetValue
TlsSetValue
GlobalReAlloc
GlobalLock
TlsFree
GlobalHandle
GlobalUnlock
TlsAlloc
LocalFree
GetModuleFileNameW
lstrcpynW
SetLastError
MultiByteToWideChar
WideCharToMultiByte
InterlockedDecrement
InterlockedIncrement
GetCurrentThreadId
FreeLibrary
HeapFree
IsBadReadPtr
LoadLibraryA
VirtualProtect
GetProcessHeap
HeapAlloc
SetUnhandledExceptionFilter
SetErrorMode
OpenEventW
GetLocalTime
GetVersionExW
lstrlenA
GetSystemInfo
GlobalMemoryStatusEx
GetDriveTypeW
GetDiskFreeSpaceExW
GetACP
SetStdHandle
GlobalAlloc
GlobalFree
GetModuleHandleW
GetProcAddress
GetCurrentProcess
GetLastError
TerminateThread
GetFileAttributesW
CreateThread
lstrlenW
DeleteFileW
WriteFile
SystemTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
LocalAlloc
FindFirstFileW
CreateFileW
GetFileSize
SetFilePointer
ReadFile
LocalSize
LocalReAlloc
FindNextFileW
GetTempPathW
lstrcatW
lstrcpyW
Sleep
CancelIo
InterlockedExchange
SetEvent
ResetEvent
GetTickCount
WaitForSingleObject
CloseHandle
CreateEventW
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
ExitProcess
InitializeCriticalSection

user32

AdjustWindowRectEx
SetFocus
GetSysColor
MapWindowPoints
PostMessageW
LoadIconW
SetWindowTextW
LoadCursorW
GetSysColorBrush
ReleaseDC
GetDC
GetClassNameW
PtInRect
ClientToScreen
PostQuitMessage
DestroyMenu
TabbedTextOutW
DrawTextW
GrayStringW
GetClientRect
CopyRect
GetCapture
WinHelpW
GetClassInfoW
RegisterClassW
GetMenu
GetMenuItemCount
GetSubMenu
GetMenuItemID
GetDlgItem
GetWindowTextW
GetDlgCtrlID
DestroyWindow
CreateWindowExW
SetPropW
GetPropW
CallWindowProcW
RemovePropW
DefWindowProcW
GetMessageTime
GetMessagePos
GetForegroundWindow
SetForegroundWindow
GetWindow
SetWindowLongW
SetWindowPos
RegisterWindowMessageW
SystemParametersInfoW
IsIconic
GetWindowPlacement
GetWindowRect
GetSystemMetrics
GetMenuCheckMarkDimensions
LoadBitmapW
GetMenuState
ModifyMenuW
SetMenuItemBitmaps
CheckMenuItem
EnableMenuItem
GetFocus
GetNextDlgTabItem
DispatchMessageW
GetKeyState
CallNextHookEx
PeekMessageW
wsprintfW
ExitWindowsEx
SetProcessWindowStation
OpenWindowStationW
GetTopWindow
SetWindowsHookExW
UnhookWindowsHookEx
GetParent
GetLastActivePopup
IsWindowEnabled
GetWindowLongW
SendMessageW
MessageBoxW
EnableWindow
LoadStringW
OpenDesktopW
OpenInputDesktop
GetThreadDesktop
GetUserObjectInformationA
SetThreadDesktop
CloseDesktop
GetProcessWindowStation

gdi32

ScaleViewportExtEx
SetWindowExtEx
ScaleWindowExtEx
SetViewportOrgEx
SetViewportExtEx
PtVisible
RectVisible
TextOutW
ExtTextOutW
Escape
SetMapMode
GetStockObject
SelectObject
RestoreDC
SaveDC
DeleteDC
DeleteObject
GetDeviceCaps
GetObjectW
SetBkColor
SetTextColor
GetClipBox
OffsetViewportOrgEx
CreateBitmap

winspool.drv

OpenPrinterW
DocumentPropertiesW
ClosePrinter

advapi32

GetTokenInformation
RegCreateKeyExW
RegOpenKeyExW
AllocateAndInitializeSid
CheckTokenMembership
FreeSid
AdjustTokenPrivileges
LookupAccountSidW
RegSetValueExW
RegOpenKeyW
RegQueryValueExW
RegCloseKey
OpenProcessToken
LookupPrivilegeValueW

comctl32

ord17

ws2_32

WSACleanup
WSAIoctl
setsockopt
connect
htons
gethostbyname
WSAStartup
ntohs
recv
closesocket
select
send
gethostname
getsockname
socket

avicap32

capGetDriverDescriptionW

Exports

Exports

DllEntry
Init

Sections

.text
Size: 128KB - Virtual size: 124KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4ffa3338ea9c6142fb4ff98513e5c47d

Headers

File Characteristics

Imports

kernel32

user32

gdi32

winspool.drv

advapi32

comctl32

ws2_32

avicap32

Exports

Exports

Sections

.text Size: 128KB - Virtual size: 124KB

.rdata Size: 24KB - Virtual size: 23KB

.data Size: 24KB - Virtual size: 38KB

.reloc Size: 16KB - Virtual size: 13KB

.text
Size: 128KB - Virtual size: 124KB

.rdata
Size: 24KB - Virtual size: 23KB

.data
Size: 24KB - Virtual size: 38KB

.reloc
Size: 16KB - Virtual size: 13KB