gh0strat | 501c5193d08688f91c22fb62f225a2bbf464f835e3f76792fbbd142a8aee07af

Sharing

Copy URL Twitter E-mail

General

Target
501c5193d08688f91c22fb62f225a2bbf464f835e3f76792fbbd142a8aee07af
Size 51KB
Sample241114-ckd3bstajf
SHA256 501c5193d08688f91c22fb62f225a2bbf464f835e3f76792fbbd142a8aee07af
MD5 f69af210418dca954f85ad1a9a014a10
SHA1 894267bb35c4146d2ef4bc6de5e573cec3e3dac2
SHA512 0467f34394db34012f15f9542f64345a9c8b025e49b8f063ff4ccb30823bd59ce3369b70d658a60d5fb3106af2038e88eb370d34ff6213ceec0f44269ddd4e7e
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLZJYH5:1dWubF3n9S91BF3fbolJYH5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
501c5193d08688f91c22fb62f225a2bbf464f835e3f76792fbbd142a8aee07af

File Explorer

501c5193d08688f91c22fb62f225a2bbf464f835e3f76792fbbd142a8aee07af

.dll 51KB

501c5193d08688f91c22fb62f225a2bbf464f835e3f76792fbbd142a8aee07af

IMPHASH 4847c8aea5b26a115e9f4b1fffee02d5
SHA256 501c5193d08688f91c22fb62f225a2bbf464f835e3f76792fbbd142a8aee07af
MD5 f69af210418dca954f85ad1a9a014a10
SHA1 894267bb35c4146d2ef4bc6de5e573cec3e3dac2
SHA512 0467f34394db34012f15f9542f64345a9c8b025e49b8f063ff4ccb30823bd59ce3369b70d658a60d5fb3106af2038e88eb370d34ff6213ceec0f44269ddd4e7e
SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLZJYH5:1dWubF3n9S91BF3fbolJYH5
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Gh0st RAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

38440

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

lstrlenA lstrcpyA FreeLibrary GetProcAddress LoadLibraryA GetTickCount WinExec ReadFile GetFileAttributesA LocalFree LocalSize LocalAlloc lstrcatA GetCurrentProcessId Process32Next TerminateProcess OpenProcess Process32First CopyFileA GetModuleFileNameA GetLastError WaitForSingleObject CreateProcessA GetCurrentDirectoryA FreeConsole GetModuleHandleA HeapAlloc GetProcessHeap VirtualProtect HeapFree InitializeCriticalSection DeleteCriticalSection CreateThread LeaveCriticalSection EnterCriticalSection SetEvent CreateEventA WritePrivateProfileStringA GetSystemDirectoryA GetPrivateProfileStringA lstrcmpiA GetFileSize CreateFileA SetFilePointer WriteFile CloseHandle Sleep InterlockedExchange VirtualAlloc GlobalMemoryStatusEx VirtualFree

user32

GetWindowThreadProcessId GetLastInputInfo wsprintfA ChangeDisplaySettingsA GetSystemMetrics

advapi32

RegQueryValueA RegSetValueExA RegCloseKey CloseServiceHandle ControlService QueryServiceStatus OpenServiceA OpenSCManagerA RegOpenKeyExA

shell32

SHGetSpecialFolderPathA

ole32

CoCreateInstance CoInitialize

oleaut32

VariantClear VariantInit

mfc42

ord825 ord823

msvcrt

_strupr _strcmpi _stricmp _strnicmp _onexit ??1type_info@@UAE@XZ _beginthreadex _errno realloc strchr _adjust_fdiv __dllonexit _initterm ceil _ftol __CxxFrameHandler _CxxThrowException _except_handler3 _local_unwind2 rand strstr strncpy strrchr free malloc printf atoi strcspn wcstombs

urlmon

URLDownloadToFileA

ws2_32

connect inet_addr getsockname WSAStartup WSACleanup closesocket ntohs listen bind socket accept htons gethostbyname sendto recvfrom __WSAFDIsSet select send recv getpeername inet_ntoa

iphlpapi

GetIfTable GetAdaptersInfo