PluginMe
Behavioral task
behavioral1
Sample
294e24d0bbd82610de5ab490eb8ab64c42b9b3e8e577b23d305f28d0d2eb5971.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
294e24d0bbd82610de5ab490eb8ab64c42b9b3e8e577b23d305f28d0d2eb5971.dll
Resource
win10v2004-20240802-en
General
-
Target
294e24d0bbd82610de5ab490eb8ab64c42b9b3e8e577b23d305f28d0d2eb5971
-
Size
546KB
-
MD5
4bd15fb1689fa88433f6d089920a8910
-
SHA1
5083deac13d7703063f392444567afda0befa4c6
-
SHA256
294e24d0bbd82610de5ab490eb8ab64c42b9b3e8e577b23d305f28d0d2eb5971
-
SHA512
131728f28a10088a65939c6df91760c33c2ce75c66cedc4e8eaccd5619d95b9ccc351584dda4fd08af1d313661bce121bb4b5bdd668e98f34b1d69a1b8ab1e5c
-
SSDEEP
12288:Y6ktTb6ktT66ktT66ktTb6ktT66ktTb6ktT66ktT66ktTb6ktTb6ktTb6ktTx:YltTbltT6ltT6ltTbltT6ltTbltT6lty
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 294e24d0bbd82610de5ab490eb8ab64c42b9b3e8e577b23d305f28d0d2eb5971
Files
-
294e24d0bbd82610de5ab490eb8ab64c42b9b3e8e577b23d305f28d0d2eb5971.dll windows:4 windows x86 arch:x86
e18ef175922dbd934e3f17dc89443628
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
msvcrt
??1type_info@@UAE@XZ
free
malloc
_except_handler3
_beginthreadex
_CxxThrowException
??2@YAPAXI@Z
__CxxFrameHandler
??3@YAXPAX@Z
_ftol
ceil
memmove
ws2_32
recv
closesocket
send
select
socket
gethostbyname
htons
connect
setsockopt
WSAIoctl
WSACleanup
WSAStartup
kernel32
GetProcAddress
FreeLibrary
LoadLibraryA
GlobalFree
CancelIo
InterlockedExchange
SetEvent
GlobalUnlock
GlobalLock
GlobalAlloc
GetTickCount
lstrcmpiA
GetCurrentThreadId
Sleep
GlobalSize
InitializeCriticalSection
DeleteCriticalSection
VirtualFree
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
CreateEventA
CloseHandle
WaitForSingleObject
ResetEvent
user32
GetThreadDesktop
LoadCursorA
DestroyCursor
BlockInput
SendMessageA
SystemParametersInfoA
keybd_event
MapVirtualKeyA
SetCapture
WindowFromPoint
SetCursorPos
mouse_event
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetClipboardData
GetSystemMetrics
SetRect
GetDC
GetDesktopWindow
ReleaseDC
GetCursorInfo
GetCursorPos
CloseDesktop
SetThreadDesktop
OpenInputDesktop
GetUserObjectInformationA
gdi32
SelectObject
CreateCompatibleDC
DeleteObject
DeleteDC
BitBlt
GetDIBits
CreateCompatibleBitmap
CreateDIBSection
Exports
Exports
Sections
.text Size: 28KB - Virtual size: 27KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 509B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ