gh0strat | 15fee4b94360efc3e9eae486b9bc12b4d3220122cfe8a6e7b4d1bffa261de485

Sharing

Copy URL

Twitter E-mail

General

Target

15fee4b94360efc3e9eae486b9bc12b4d3220122cfe8a6e7b4d1bffa261de485
Size

4.9MB
MD5

38705a0070eeb59331c22e7a52cae73c
SHA1

a23ba18f0ccec338fb215529726868c27946072c
SHA256

15fee4b94360efc3e9eae486b9bc12b4d3220122cfe8a6e7b4d1bffa261de485
SHA512

7732cb50dbdfa0585ebca2c7198f761369272fe8281475d0f1033294f7df5d91ccad794a243d383a3e65ee2b23e64d8367f7496d433c2633ba8b647255bbc85e
SSDEEP

49152:Lw35raHEpFgD17SxZUdhN95upTKzwFC17/ksn8u3OVNFNzIHVw5CLVhaus9Pi:LirxuUZ8z+I/kIAFCVwgh4uQP

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
15fee4b94360efc3e9eae486b9bc12b4d3220122cfe8a6e7b4d1bffa261de485

Files

15fee4b94360efc3e9eae486b9bc12b4d3220122cfe8a6e7b4d1bffa261de485
.exe windows:4 windows x86 arch:x86

df1f9c2ab836242a9ab24499b3b78682

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

avifil32

AVIStreamRelease
AVIFileRelease
AVIStreamWrite
AVIFileOpenA
AVIFileCreateStreamA
AVIStreamSetFormat
AVIFileExit
AVIFileInit

msvfw32

DrawDibOpen
DrawDibClose
DrawDibDraw

shlwapi

SHAutoComplete

winmm

waveInStart
PlaySoundA
waveOutGetNumDevs
waveOutOpen
waveOutPrepareHeader
waveInGetNumDevs
waveInOpen
waveInPrepareHeader
waveInAddBuffer
waveOutWrite
waveInStop
waveInReset
waveInUnprepareHeader
waveInClose
waveOutReset
waveOutUnprepareHeader
waveOutClose

kernel32

UnhandledExceptionFilter
SetHandleCount
GetStdHandle
GetFileType
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
IsBadReadPtr
IsBadCodePtr
SetStdHandle
CompareStringA
CompareStringW
SetEnvironmentVariableA
CreateEventA
CloseHandle
TerminateThread
WaitForSingleObject
SetEvent
ResumeThread
Sleep
VirtualFree
VirtualAlloc
GetFileAttributesA
lstrcatA
GetModuleFileNameA
WriteFile
lstrcpyA
ReadFile
GetFileSize
CreateFileA
GetProfileIntA
GetProfileStringA
GetTempPathA
GetPrivateProfileSectionNamesA
EnumResourceLanguagesA
EnumResourceNamesA
EnumResourceTypesA
GetExitCodeThread
CreateThread
IsBadWritePtr
GetTickCount
GetProcAddress
LoadLibraryA
SetUnhandledExceptionFilter
lstrlenA
LocalFree
LocalAlloc
lstrcpynA
FindClose
FindNextFileA
FindFirstFileA
SetFilePointer
DeleteFileA
MoveFileA
GetLastError
CreateDirectoryA
GetPrivateProfileStringA
GetPrivateProfileIntA
WritePrivateProfileStringA
InitializeCriticalSection
LeaveCriticalSection
PostQueuedCompletionStatus
EnterCriticalSection
GetSystemInfo
CreateIoCompletionPort
InterlockedDecrement
GetQueuedCompletionStatus
InterlockedExchange
CancelIo
DeleteCriticalSection
GlobalUnlock
GlobalLock
GlobalAlloc
FreeLibrary
OutputDebugStringA
GetLocalTime
GlobalFree
MulDiv
LockResource
SizeofResource
LoadResource
FindResourceA
ResetEvent
GlobalSize
LocalSize
LocalReAlloc
lstrcmpA
GetModuleHandleA
GlobalDeleteAtom
GlobalFindAtomA
GlobalAddAtomA
lstrcmpiA
GlobalGetAtomNameA
GetCurrentThreadId
GetVersion
InterlockedIncrement
WideCharToMultiByte
MultiByteToWideChar
FormatMessageA
FileTimeToSystemTime
FileTimeToLocalFileTime
lstrlenW
DuplicateHandle
GetCurrentProcess
FlushFileBuffers
LockFile
UnlockFile
SetEndOfFile
GetVolumeInformationA
GetFullPathNameA
GetStringTypeExA
GetThreadLocale
GetShortPathNameA
SetLastError
GetCurrentThread
SetThreadPriority
GetTempFileNameA
SetFileTime
GetFileTime
GetDiskFreeSpaceA
GlobalFlags
TlsAlloc
GlobalHandle
TlsFree
GlobalReAlloc
TlsSetValue
TlsGetValue
GetProcessVersion
GetCPInfo
GetOEMCP
CopyFileA
LocalFileTimeToFileTime
SystemTimeToFileTime
SetFileAttributesA
SetErrorMode
GetCurrentDirectoryA
HeapFree
HeapAlloc
RtlUnwind
ExitThread
RaiseException
GetStartupInfoA
GetCommandLineA
ExitProcess
TerminateProcess
GetTimeZoneInformation
GetSystemTime
GetACP
HeapReAlloc
HeapSize
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate

user32

SetScrollInfo
GetScrollRange
SetScrollRange
GetScrollPos
SetScrollPos
GetTopWindow
IsChild
GetCapture
WinHelpA
GetClassInfoA
RegisterClassA
GetMenu
GetMenuItemID
TrackPopupMenu
SetWindowPlacement
GetWindowTextLengthA
GetWindowTextA
CreateWindowExA
SetWindowsHookExA
CallNextHookEx
GetClassLongA
SetPropA
UnhookWindowsHookEx
GetPropA
CallWindowProcA
RemovePropA
DefWindowProcA
GetMessageTime
GetMessagePos
GetLastActivePopup
GetForegroundWindow
SetForegroundWindow
IntersectRect
IsIconic
GetWindowPlacement
GetNextDlgTabItem
EndDialog
GetActiveWindow
SetActiveWindow
IsWindow
CreateDialogIndirectParamA
DestroyWindow
GetDlgItem
IsWindowEnabled
EndDeferWindowPos
GetMenuStringA
InsertMenuA
DeleteMenu
SystemParametersInfoA
GetScrollInfo
DrawTextA
SetWindowContextHelpId
MapDialogRect
SetRectEmpty
LoadAcceleratorsA
TranslateAcceleratorA
DestroyMenu
SetMenu
ReuseDDElParam
ShowScrollBar
DrawIconEx
GetKeyState
GetWindowLongA
SetWindowLongA
GetMenuState
CheckMenuRadioItem
SetClassLongA
ClipCursor
DestroyCursor
CopyRect
FillRect
GetDC
ReleaseDC
BeginDeferWindowPos
DeferWindowPos
EqualRect
AdjustWindowRectEx
SetFocus
PeekMessageA
MapWindowPoints
SendDlgItemMessageA
CreatePopupMenu
RedrawWindow
LoadImageA
GetFocus
KillTimer
GetDesktopWindow
LoadBitmapA
SetTimer
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
GetSystemMenu
UnpackDDElParam
BringWindowToTop
GetClipboardData
ScrollWindow
CreateMenu
GetDlgItemTextA
DispatchMessageA
TranslateMessage
GetMessageA
LoadIconA
SendMessageA
InvalidateRect
EnableWindow
RegisterWindowMessageA
SetRect
MessageBoxA
wsprintfA
PostMessageA
PtInRect
GetWindowRect
GetCursorPos
GetSubMenu
LoadMenuA
GetSysColor
GetWindow
GetClientRect
SetCapture
UnregisterClassA
DrawMenuBar
TranslateMDISysAccel
DefFrameProcA
SetDlgItemTextA
GetScrollBarInfo
IsDialogMessageA
SetWindowTextA
MoveWindow
ShowWindow
SetMenuItemBitmaps
ModifyMenuA
GetMenuCheckMarkDimensions
wvsprintfA
CharUpperA
GetWindowDC
BeginPaint
EndPaint
TabbedTextOutA
GrayStringA
PostQuitMessage
ShowOwnedPopups
PostThreadMessageA
InvertRect
IsRectEmpty
SetParent
RegisterClipboardFormatA
LockWindowUpdate
GetDCEx
GetNextDlgGroupItem
CopyAcceleratorTableA
DestroyIcon
GetSysColorBrush
GetDialogBaseUnits
GetClassNameA
LoadStringA
IsZoomed
ExcludeUpdateRgn
DefDlgProcA
GetTabbedTextExtentA
GetClipboardFormatNameA
GetAsyncKeyState
IsWindowUnicode
GetWindowLongW
SetWindowLongW
DrawEdge
GetDoubleClickTime
SetCursorPos
UnionRect
GetMenuDefaultItem
ValidateRect
SetWindowRgn
GetCursor
GetMenuStringW
LookupIconIdFromDirectoryEx
GetKeyboardLayoutList
GetKeyboardState
ToAsciiEx
GetKeyboardLayout
MapVirtualKeyExA
GetKeyNameTextA
IsCharLowerA
IsClipboardFormatAvailable
GetWindowRgn
HideCaret
AppendMenuA
MessageBeep
InflateRect
GetSystemMetrics
OffsetRect
CharNextA
EnableMenuItem
GetMenuItemCount
CheckMenuItem
GetDlgCtrlID
SetWindowPos
SendMessageTimeoutA
IsWindowVisible
GetParent
ReleaseCapture
ClientToScreen
WindowFromPoint
UpdateWindow
ScreenToClient
SetCursor
LoadCursorA
DrawStateA
DrawFocusRect
MapVirtualKeyA
WaitMessage
SetMenuDefaultItem
EnumChildWindows
FindWindowA
DrawAnimatedRects
DrawFrameControl
CreateIconFromResourceEx
GetIconInfo
CreateIconIndirect
CopyIcon
GetMenuItemInfoA
IsMenu
ShowCaret

gdi32

GetBitmapBits
EnumFontFamiliesExA
PtInRegion
GetDIBits
StretchBlt
GetCurrentObject
ExtCreateRegion
SetPixel
GetTextAlign
GetWindowOrgEx
Polygon
GetRgnBox
CreatePolygonRgn
RoundRect
GetViewportOrgEx
ExtFloodFill
Ellipse
SetBrushOrgEx
StrokePath
FillPath
StrokeAndFillPath
EndPath
CloseFigure
BeginPath
GetTextExtentPoint32W
ExtTextOutW
GetTextExtentPointA
CreateDIBitmap
GetPixel
Polyline
CombineRgn
SetRectRgn
GetMapMode
LPtoDP
DPtoLP
GetBkColor
GetTextColor
CopyMetaFileA
CreateFontIndirectA
CreateFontA
GetCharWidthA
GetTextMetricsA
GetTextExtentPoint32A
CreateRectRgnIndirect
PatBlt
Escape
RectVisible
PtVisible
CreatePatternBrush
GetWindowExtEx
GetViewportExtEx
ExtSelectClipRgn
CreateRectRgn
GetClipRgn
PolyBezierTo
GetCurrentPositionEx
SetTextAlign
LineTo
MoveToEx
IntersectClipRect
ExcludeClipRect
SelectClipRgn
ScaleWindowExtEx
SetWindowExtEx
SetWindowOrgEx
ScaleViewportExtEx
SetViewportExtEx
OffsetViewportOrgEx
SetViewportOrgEx
SetMapMode
SetStretchBltMode
SetPolyFillMode
GetStockObject
RestoreDC
SaveDC
CreateBitmap
GetClipBox
SetBkMode
TextOutA
GetObjectA
CreatePen
SetBkColor
SetTextColor
ExtTextOutA
StretchDIBits
CreateDIBSection
CreateSolidBrush
BitBlt
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteDC
DeleteObject
GetDeviceCaps

comdlg32

GetFileTitleA
GetOpenFileNameA
GetSaveFileNameA
ChooseColorA

winspool.drv

OpenPrinterA
DocumentPropertiesA
ClosePrinter

advapi32

RegQueryValueExA
RegCreateKeyA
RegSetValueA
GetFileSecurityA
SetFileSecurityA
RegDeleteValueA
RegCloseKey
RegOpenKeyA
RegQueryValueA
RegSetValueExA
RegEnumKeyA
RegDeleteKeyA
RegCreateKeyExA
RegOpenKeyExA

shell32

Shell_NotifyIconA
SHGetMalloc
DragQueryFileA
DragFinish
ShellExecuteA
SHAppBarMessage
ExtractIconA
SHBrowseForFolderA
SHGetPathFromIDListA
SHGetFileInfoA
SHGetSpecialFolderLocation

comctl32

ImageList_Remove
ImageList_GetImageInfo
ImageList_Add
ImageList_DrawEx
ImageList_GetIcon
ImageList_GetIconSize
ImageList_GetImageCount
ImageList_Draw
_TrackMouseEvent
ImageList_ReplaceIcon
ImageList_SetBkColor
ImageList_AddMasked
ord17
ImageList_Destroy
ImageList_Create
ImageList_LoadImageA

oledlg

ord1
ord8

ole32

ReleaseStgMedium
CoGetClassObject
StgOpenStorageOnILockBytes
StgCreateDocfileOnILockBytes
CoTaskMemFree
CreateILockBytesOnHGlobal
OleRun
CLSIDFromProgID
CoCreateInstance
OleInitialize
OleUninitialize
CoFreeUnusedLibraries
CoRegisterMessageFilter
CoRevokeClassObject
CoUninitialize
CoInitialize
CoTaskMemAlloc
OleDuplicateData
OleFlushClipboard
CoDisconnectObject
OleIsCurrentClipboard
RegisterDragDrop
CoLockObjectExternal
RevokeDragDrop
OleGetClipboard
CLSIDFromString

olepro32

ord253

oleaut32

OleLoadPicturePath
VariantChangeTypeEx
LoadTypeLi
SysStringLen
VariantTimeToSystemTime
SysAllocStringLen
SysFreeString
VarBstrFromDate
VarDateFromStr
SysStringByteLen
VariantChangeType
SysAllocStringByteLen
SysAllocString
VariantCopy
VariantClear
SafeArrayGetDim
SafeArrayGetElemsize
SafeArrayGetLBound
SafeArrayGetUBound
SafeArrayAccessData
SafeArrayUnaccessData

ws2_32

WSACleanup
inet_ntoa
getpeername
select
connect
htons
gethostbyname
ioctlsocket
socket
WSAStartup
listen
bind
WSAEventSelect
WSASocketA
WSAWaitForMultipleEvents
WSAEnumNetworkEvents
WSAGetLastError
accept
WSARecv
WSASend
setsockopt
WSACloseEvent
WSAIoctl
gethostname
ntohs
getsockname
shutdown
closesocket
WSACreateEvent

imm32

ImmAssociateContext

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rotext
Size: 112KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 392KB - Virtual size: 388KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1.5MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 904KB - Virtual size: 903KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

df1f9c2ab836242a9ab24499b3b78682

Headers

File Characteristics

Imports

avifil32

msvfw32

shlwapi

winmm

kernel32

user32

gdi32

comdlg32

winspool.drv

advapi32

shell32

comctl32

oledlg

ole32

olepro32

oleaut32

ws2_32

imm32

Sections

.text Size: 2.1MB - Virtual size: 2.1MB

.rodata Size: 12KB - Virtual size: 11KB

.rotext Size: 112KB - Virtual size: 108KB

.rdata Size: 392KB - Virtual size: 388KB

.data Size: 1.5MB - Virtual size: 1.9MB

.rsrc Size: 904KB - Virtual size: 903KB

.text
Size: 2.1MB - Virtual size: 2.1MB

.rodata
Size: 12KB - Virtual size: 11KB

.rotext
Size: 112KB - Virtual size: 108KB

.rdata
Size: 392KB - Virtual size: 388KB

.data
Size: 1.5MB - Virtual size: 1.9MB

.rsrc
Size: 904KB - Virtual size: 903KB