gh0strat | ee1148ee60ce31962af096aca01555b53db3abe7ce575b9b6efea24ca70ee9bf

General

Target

ee1148ee60ce31962af096aca01555b53db3abe7ce575b9b6efea24ca70ee9bf
Size

961KB
MD5

d1ad2c8fc2c9a1d2eca68a4ffa862777
SHA1

aa8a04ee939ab7288c50799e5b7c003e8d716175
SHA256

ee1148ee60ce31962af096aca01555b53db3abe7ce575b9b6efea24ca70ee9bf
SHA512

b6cb7f16a9b8522fe9509c7590e9720cbaf6a47364d55c5b4133da834713e160cc7884150b261f01bc8f4a6accbf457fea55d7808e0f7b00871142e34bfd7b08
SSDEEP

24576:YltTaltTLltTaltTqltTaltTaltT7ltTLltT6ltT7ltT7ltTKltTbltTKltTalt3:eTQTnTQTATQTQT3TnTwT3T3TgTXTgTQ3

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ee1148ee60ce31962af096aca01555b53db3abe7ce575b9b6efea24ca70ee9bf

Files

ee1148ee60ce31962af096aca01555b53db3abe7ce575b9b6efea24ca70ee9bf
.dll windows:4 windows x86 arch:x86

e18ef175922dbd934e3f17dc89443628

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

??1type_info@@UAE@XZ
free
malloc
_except_handler3
_beginthreadex
_CxxThrowException
??2@YAPAXI@Z
__CxxFrameHandler
??3@YAXPAX@Z
_ftol
ceil
memmove

ws2_32

recv
closesocket
send
select
socket
gethostbyname
htons
connect
setsockopt
WSAIoctl
WSACleanup
WSAStartup

kernel32

GetProcAddress
FreeLibrary
LoadLibraryA
GlobalFree
CancelIo
InterlockedExchange
SetEvent
GlobalUnlock
GlobalLock
GlobalAlloc
GetTickCount
lstrcmpiA
GetCurrentThreadId
Sleep
GlobalSize
InitializeCriticalSection
DeleteCriticalSection
VirtualFree
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
CreateEventA
CloseHandle
WaitForSingleObject
ResetEvent

user32

GetThreadDesktop
LoadCursorA
DestroyCursor
BlockInput
SendMessageA
SystemParametersInfoA
keybd_event
MapVirtualKeyA
SetCapture
WindowFromPoint
SetCursorPos
mouse_event
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetClipboardData
GetSystemMetrics
SetRect
GetDC
GetDesktopWindow
ReleaseDC
GetCursorInfo
GetCursorPos
CloseDesktop
SetThreadDesktop
OpenInputDesktop
GetUserObjectInformationA

gdi32

SelectObject
CreateCompatibleDC
DeleteObject
DeleteDC
BitBlt
GetDIBits
CreateCompatibleBitmap
CreateDIBSection

Exports

Exports

PluginMe

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 509B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e18ef175922dbd934e3f17dc89443628

Headers

File Characteristics

Imports

msvcrt

ws2_32

kernel32

user32

gdi32

Exports

Exports

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 14KB - Virtual size: 13KB

.data Size: 512B - Virtual size: 509B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 14KB - Virtual size: 13KB

.data
Size: 512B - Virtual size: 509B

.reloc
Size: 2KB - Virtual size: 1KB