gh0strat | 484b72594c6a986bb0b8f1df4e29c720N

General

Target

484b72594c6a986bb0b8f1df4e29c720N
Size

283KB
MD5

484b72594c6a986bb0b8f1df4e29c720
SHA1

85c06d7c11ded1f69b77474b37d09c696792bef4
SHA256

9a9d06a0ab993ef6cd5cdf5d3930b272bf855fe636424f19a2d869ae6565fb90
SHA512

7a97fad2165a7f72a64d2ae52bad623837e92c1f91c0922e75951134b454ae80523e5e3a9463947a0b45208c26d1c798a27ba4af41e5c1cb4320a9c0d5693b04
SSDEEP

6144:YqBktTBD1LqBktTBD1rqBktTBD16qBktTBD17qBktTBD1qqBktTBD1+:Y6ktTr6ktTL6ktTa6ktTb6ktTK6ktTe

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
484b72594c6a986bb0b8f1df4e29c720N

Files

484b72594c6a986bb0b8f1df4e29c720N
.dll windows:4 windows x86 arch:x86

e18ef175922dbd934e3f17dc89443628

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

??1type_info@@UAE@XZ
free
malloc
_except_handler3
_beginthreadex
_CxxThrowException
??2@YAPAXI@Z
__CxxFrameHandler
??3@YAXPAX@Z
_ftol
ceil
memmove

ws2_32

recv
closesocket
send
select
socket
gethostbyname
htons
connect
setsockopt
WSAIoctl
WSACleanup
WSAStartup

kernel32

GetProcAddress
FreeLibrary
LoadLibraryA
GlobalFree
CancelIo
InterlockedExchange
SetEvent
GlobalUnlock
GlobalLock
GlobalAlloc
GetTickCount
lstrcmpiA
GetCurrentThreadId
Sleep
GlobalSize
InitializeCriticalSection
DeleteCriticalSection
VirtualFree
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
CreateEventA
CloseHandle
WaitForSingleObject
ResetEvent

user32

GetThreadDesktop
LoadCursorA
DestroyCursor
BlockInput
SendMessageA
SystemParametersInfoA
keybd_event
MapVirtualKeyA
SetCapture
WindowFromPoint
SetCursorPos
mouse_event
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetClipboardData
GetSystemMetrics
SetRect
GetDC
GetDesktopWindow
ReleaseDC
GetCursorInfo
GetCursorPos
CloseDesktop
SetThreadDesktop
OpenInputDesktop
GetUserObjectInformationA

gdi32

SelectObject
CreateCompatibleDC
DeleteObject
DeleteDC
BitBlt
GetDIBits
CreateCompatibleBitmap
CreateDIBSection

Exports

Exports

PluginMe

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 509B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e18ef175922dbd934e3f17dc89443628

Headers

File Characteristics

Imports

msvcrt

ws2_32

kernel32

user32

gdi32

Exports

Exports

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 14KB - Virtual size: 13KB

.data Size: 512B - Virtual size: 509B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 14KB - Virtual size: 13KB

.data
Size: 512B - Virtual size: 509B

.reloc
Size: 2KB - Virtual size: 1KB