gh0strat | 1c823f4b9c9b3554975915af3a636bf0N

General

Target

1c823f4b9c9b3554975915af3a636bf0N
Size

829KB
MD5

1c823f4b9c9b3554975915af3a636bf0
SHA1

7da6c4a378580d7f900de2bef3fc93bb3dcdbd43
SHA256

c32a6479a836f24a5ab24c58891741b176be93dfa183b52b258e759cfc5b7a13
SHA512

d7f0a7f5c3a01769113d0094c8e0d6293938ad2adfb407221ecd1e76329775366bab3bd44e10fc33ae425ab2c0a51a2383d1f1633faa0ad606ba472088ce606b
SSDEEP

24576:YltT7ltTbltTaltT6ltTbltTLltTaltT6ltT6ltT7ltTKltTKltTbltT6ltT7ltf:eT3TXTQTwTXTnTQTwTwT3TgTgTXTwT3f

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1c823f4b9c9b3554975915af3a636bf0N

Files

1c823f4b9c9b3554975915af3a636bf0N
.dll windows:4 windows x86 arch:x86

e18ef175922dbd934e3f17dc89443628

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

msvcrt

??1type_info@@UAE@XZ
free
malloc
_except_handler3
_beginthreadex
_CxxThrowException
??2@YAPAXI@Z
__CxxFrameHandler
??3@YAXPAX@Z
_ftol
ceil
memmove

ws2_32

recv
closesocket
send
select
socket
gethostbyname
htons
connect
setsockopt
WSAIoctl
WSACleanup
WSAStartup

kernel32

GetProcAddress
FreeLibrary
LoadLibraryA
GlobalFree
CancelIo
InterlockedExchange
SetEvent
GlobalUnlock
GlobalLock
GlobalAlloc
GetTickCount
lstrcmpiA
GetCurrentThreadId
Sleep
GlobalSize
InitializeCriticalSection
DeleteCriticalSection
VirtualFree
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
CreateEventA
CloseHandle
WaitForSingleObject
ResetEvent

user32

GetThreadDesktop
LoadCursorA
DestroyCursor
BlockInput
SendMessageA
SystemParametersInfoA
keybd_event
MapVirtualKeyA
SetCapture
WindowFromPoint
SetCursorPos
mouse_event
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetClipboardData
GetSystemMetrics
SetRect
GetDC
GetDesktopWindow
ReleaseDC
GetCursorInfo
GetCursorPos
CloseDesktop
SetThreadDesktop
OpenInputDesktop
GetUserObjectInformationA

gdi32

SelectObject
CreateCompatibleDC
DeleteObject
DeleteDC
BitBlt
GetDIBits
CreateCompatibleBitmap
CreateDIBSection

Exports

Exports

PluginMe

Sections

.text
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 509B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e18ef175922dbd934e3f17dc89443628

Headers

File Characteristics

Imports

msvcrt

ws2_32

kernel32

user32

gdi32

Exports

Exports

Sections

.text Size: 28KB - Virtual size: 27KB

.rdata Size: 14KB - Virtual size: 13KB

.data Size: 512B - Virtual size: 509B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 28KB - Virtual size: 27KB

.rdata
Size: 14KB - Virtual size: 13KB

.data
Size: 512B - Virtual size: 509B

.reloc
Size: 2KB - Virtual size: 1KB