gh0strat | d8c1b32bc694029d009a3edbc51823b90bbb814a9b7941d6da68990cb4aafff9

General

Target

d8c1b32bc694029d009a3edbc51823b90bbb814a9b7941d6da68990cb4aafff9
Size

203KB
MD5

5e58b20f88337d85bcc8406bb0139e64
SHA1

1e781d6b2a42d465061e457c78cc788e46b77723
SHA256

d8c1b32bc694029d009a3edbc51823b90bbb814a9b7941d6da68990cb4aafff9
SHA512

06b0916335d7006ad263b767c7beab394498843dbfb8d78f793de4835e78f98718b25b8d6071b555a6c6b9991449ab025028675d2db3ffea2681a8bd1c7850d4
SSDEEP

6144:VlktTB8gblktTB8glQZ8iTaNpQMY9ElktTB8gQ:VlktTflktTZ3WaNpFnlktTk

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d8c1b32bc694029d009a3edbc51823b90bbb814a9b7941d6da68990cb4aafff9

Files

d8c1b32bc694029d009a3edbc51823b90bbb814a9b7941d6da68990cb4aafff9
.dll windows:4 windows x86 arch:x86

e18ef175922dbd934e3f17dc89443628

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

??1type_info@@UAE@XZ
free
malloc
_except_handler3
_beginthreadex
_CxxThrowException
??2@YAPAXI@Z
__CxxFrameHandler
??3@YAXPAX@Z
_ftol
ceil
memmove

ws2_32

recv
closesocket
send
select
socket
gethostbyname
htons
connect
setsockopt
WSAIoctl
WSACleanup
WSAStartup

kernel32

GetProcAddress
FreeLibrary
LoadLibraryA
GlobalFree
CancelIo
InterlockedExchange
SetEvent
GlobalUnlock
GlobalLock
GlobalAlloc
GetTickCount
lstrcmpiA
GetCurrentThreadId
Sleep
GlobalSize
InitializeCriticalSection
DeleteCriticalSection
VirtualFree
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
CreateEventA
CloseHandle
WaitForSingleObject
ResetEvent

user32

GetThreadDesktop
LoadCursorA
DestroyCursor
BlockInput
SendMessageA
SystemParametersInfoA
keybd_event
MapVirtualKeyA
SetCapture
WindowFromPoint
SetCursorPos
mouse_event
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetClipboardData
GetSystemMetrics
SetRect
GetDC
GetDesktopWindow
ReleaseDC
GetCursorInfo
GetCursorPos
CloseDesktop
SetThreadDesktop
OpenInputDesktop
GetUserObjectInformationA

gdi32

SelectObject
CreateCompatibleDC
DeleteObject
DeleteDC
BitBlt
GetDIBits
CreateCompatibleBitmap
CreateDIBSection

Exports

Exports

PluginMe

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 509B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e18ef175922dbd934e3f17dc89443628

Headers

File Characteristics

Imports

msvcrt

ws2_32

kernel32

user32

gdi32

Exports

Exports

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 14KB - Virtual size: 13KB

.data Size: 512B - Virtual size: 509B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 14KB - Virtual size: 13KB

.data
Size: 512B - Virtual size: 509B

.reloc
Size: 2KB - Virtual size: 1KB