gh0strat | cb203993d23dddfe720784dbc198fc9a6f947b272d7e28e1c4dee123761bb6b9

Sharing

Copy URL Twitter E-mail

General

Target
cb203993d23dddfe720784dbc198fc9a6f947b272d7e28e1c4dee123761bb6b9
Size 899KB
Sample241230-b4d11atmcw
SHA256 cb203993d23dddfe720784dbc198fc9a6f947b272d7e28e1c4dee123761bb6b9
MD5 447fc7e31d9742e61ef41bd7ca80f0e2
SHA1 faaed3052cf78ca3ba43bf09de10a3f73e1ee215
SHA512 aa92747aedf3c8e43b4a28a3f3b135b7c84d261e09d5c45a6b3b8cf8567a412022ac4bdd4885136edac9b31c935f45b07927f7b6f7ce4eb60f8babeec30e51a7
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXb:7wqd87Vb
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cb203993d23dddfe720784dbc198fc9a6f947b272d7e28e1c4dee123761bb6b9

File Explorer

cb203993d23dddfe720784dbc198fc9a6f947b272d7e28e1c4dee123761bb6b9

.dll 899KB

cb203993d23dddfe720784dbc198fc9a6f947b272d7e28e1c4dee123761bb6b9

IMPHASH ae118f3d7fe149b456ac30484c6830f8
SHA256 cb203993d23dddfe720784dbc198fc9a6f947b272d7e28e1c4dee123761bb6b9
MD5 447fc7e31d9742e61ef41bd7ca80f0e2
SHA1 faaed3052cf78ca3ba43bf09de10a3f73e1ee215
SHA512 aa92747aedf3c8e43b4a28a3f3b135b7c84d261e09d5c45a6b3b8cf8567a412022ac4bdd4885136edac9b31c935f45b07927f7b6f7ce4eb60f8babeec30e51a7
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXb:7wqd87Vb
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Gh0st RAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

54981

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

FindClose LocalFree FindNextFileA LocalReAlloc LocalAlloc FindFirstFileA RemoveDirectoryA SetFileAttributesA ReadFile MoveFileA WaitForSingleObject FreeLibrary GetProcAddress LoadLibraryA GetTickCount WinExec LocalSize GetCurrentProcessId Process32Next TerminateProcess OpenProcess Process32First CopyFileA GetModuleFileNameA GlobalMemoryStatusEx GetCurrentDirectoryA FreeConsole GetModuleHandleA SetEvent GetLogicalDriveStringsA GetProcessHeap VirtualProtect HeapFree InitializeCriticalSection DeleteCriticalSection CreateThread LeaveCriticalSection EnterCriticalSection GlobalFree GlobalUnlock GlobalLock GlobalAlloc GlobalSize QueryPerformanceFrequency QueryPerformanceCounter GetSystemDirectoryA GetStartupInfoA CreatePipe DisconnectNamedPipe TerminateThread PeekNamedPipe WaitForMultipleObjects CreateEventA WritePrivateProfileStringA GetPrivateProfileStringA lstrcmpiA GetCurrentThreadId GetSystemInfo GetVolumeInformationA GetDiskFreeSpaceExA GetDriveTypeA ExpandEnvironmentStringsA lstrcatA CreateProcessA lstrlenA lstrcpyA GetFileAttributesA CreateDirectoryA GetLastError DeleteFileA GetCurrentProcess IsWow64Process GetFileSize CreateFileA SetFilePointer WriteFile VirtualFree CloseHandle Sleep InterlockedExchange VirtualAlloc HeapAlloc

user32

GetUserObjectInformationA GetThreadDesktop wsprintfA SetThreadDesktop CloseDesktop GetCursorPos GetCursorInfo GetClipboardData OpenClipboard EmptyClipboard SetClipboardData CloseClipboard mouse_event MapVirtualKeyA keybd_event CharNextA SystemParametersInfoA SendMessageA ReleaseDC BlockInput DestroyCursor LoadCursorA GetDC GetLastInputInfo OpenInputDesktop GetSystemMetrics ChangeDisplaySettingsA GetWindowThreadProcessId

gdi32

CreateCompatibleBitmap GetDIBits CreateRectRgnIndirect CombineRgn GetRegionData BitBlt DeleteObject CreateCompatibleDC CreateDIBSection SelectObject DeleteDC GetDeviceCaps

advapi32

OpenServiceA QueryServiceStatus ControlService CloseServiceHandle RegQueryValueA RegOpenKeyExA RegSetValueExA RegCloseKey GetUserNameA OpenSCManagerA

shell32

SHGetFolderPathA ShellExecuteExA SHGetFileInfoA SHGetSpecialFolderPathA

ole32

CoCreateInstance CoInitialize

oleaut32

VariantClear VariantInit

mfc42

ord823 ord825

msvcrt

_strupr _stricmp _strcmpi _strnicmp exit fprintf sscanf getenv _adjust_fdiv _initterm _onexit __dllonexit ??1type_info@@UAE@XZ _beginthreadex _iob _errno realloc strchr wcstombs vsprintf sprintf ceil _ftol __CxxFrameHandler _CxxThrowException free malloc _except_handler3 strstr strncpy strrchr memmove _local_unwind2 rand printf atoi strcspn

urlmon

URLDownloadToFileA

ws2_32

inet_ntoa recv send select __WSAFDIsSet recvfrom sendto gethostbyname connect inet_addr WSAStartup WSACleanup accept socket htons bind listen getsockname ntohs closesocket getpeername

msvcp60

?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z ?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?_Xran@std@@YAXXZ ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB

iphlpapi

GetAdaptersInfo GetIfTable

Name

.text

Size

460KB

Virtual Size

460KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rodata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rotext

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

244KB

Virtual Size

244KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

48KB

Virtual Size

472KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

cb203993d23dddfe720784dbc198fc9a6f947b272d7e28e1c4dee123761bb6b9

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

mfc42

msvcrt

urlmon

ws2_32

msvcp60

iphlpapi

generic