gh0strat | 029a981def8f0ac569f7239e7f1ff9954663d7302efa7848e610a71fe35202be[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
029a981def8f0ac569f7239e7f1ff9954663d7302efa7848e610a71fe35202be.exe
Size 899KB
Sample250101-qpr2mswmbv
SHA256 029a981def8f0ac569f7239e7f1ff9954663d7302efa7848e610a71fe35202be
MD5 a2ad1712d4ca1dd58203ece494563b0f
SHA1 f585d3577e30bc2a525f0361ea5282753b798e97
SHA512 947f085fa1e726860b27b09ad6978ae4c3a4b24f5716cdf1a8c9f05940f075e69b68d0f2ba8b8108aaddacf452e3caf8d184806aaf537df188b7459dafed56ab
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXem:7wqd87Vem
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
029a981def8f0ac569f7239e7f1ff9954663d7302efa7848e610a71fe35202be.exe

File Explorer

029a981def8f0ac569f7239e7f1ff9954663d7302efa7848e610a71fe35202be.exe

.dll 899KB

029a981def8f0ac569f7239e7f1ff9954663d7302efa7848e610a71fe35202be.exe

IMPHASH ae118f3d7fe149b456ac30484c6830f8
SHA256 029a981def8f0ac569f7239e7f1ff9954663d7302efa7848e610a71fe35202be
MD5 a2ad1712d4ca1dd58203ece494563b0f
SHA1 f585d3577e30bc2a525f0361ea5282753b798e97
SHA512 947f085fa1e726860b27b09ad6978ae4c3a4b24f5716cdf1a8c9f05940f075e69b68d0f2ba8b8108aaddacf452e3caf8d184806aaf537df188b7459dafed56ab
SSDEEP 24576:7V2bG+2gMir4fgt7ibhRM5QhKehFdMtRj7nH1PXem:7wqd87Vem
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Gh0st RAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

54981

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

FindClose LocalFree FindNextFileA LocalReAlloc LocalAlloc FindFirstFileA RemoveDirectoryA SetFileAttributesA ReadFile MoveFileA WaitForSingleObject FreeLibrary GetProcAddress LoadLibraryA GetTickCount WinExec LocalSize GetCurrentProcessId Process32Next TerminateProcess OpenProcess Process32First CopyFileA GetModuleFileNameA GlobalMemoryStatusEx GetCurrentDirectoryA FreeConsole GetModuleHandleA SetEvent GetLogicalDriveStringsA GetProcessHeap VirtualProtect HeapFree InitializeCriticalSection DeleteCriticalSection CreateThread LeaveCriticalSection EnterCriticalSection GlobalFree GlobalUnlock GlobalLock GlobalAlloc GlobalSize QueryPerformanceFrequency QueryPerformanceCounter GetSystemDirectoryA GetStartupInfoA CreatePipe DisconnectNamedPipe TerminateThread PeekNamedPipe WaitForMultipleObjects CreateEventA WritePrivateProfileStringA GetPrivateProfileStringA lstrcmpiA GetCurrentThreadId GetSystemInfo GetVolumeInformationA GetDiskFreeSpaceExA GetDriveTypeA ExpandEnvironmentStringsA lstrcatA CreateProcessA lstrlenA lstrcpyA GetFileAttributesA CreateDirectoryA GetLastError DeleteFileA GetCurrentProcess IsWow64Process GetFileSize CreateFileA SetFilePointer WriteFile VirtualFree CloseHandle Sleep InterlockedExchange VirtualAlloc HeapAlloc

user32

GetUserObjectInformationA GetThreadDesktop wsprintfA SetThreadDesktop CloseDesktop GetCursorPos GetCursorInfo GetClipboardData OpenClipboard EmptyClipboard SetClipboardData CloseClipboard mouse_event MapVirtualKeyA keybd_event CharNextA SystemParametersInfoA SendMessageA ReleaseDC BlockInput DestroyCursor LoadCursorA GetDC GetLastInputInfo OpenInputDesktop GetSystemMetrics ChangeDisplaySettingsA GetWindowThreadProcessId

gdi32

CreateCompatibleBitmap GetDIBits CreateRectRgnIndirect CombineRgn GetRegionData BitBlt DeleteObject CreateCompatibleDC CreateDIBSection SelectObject DeleteDC GetDeviceCaps

advapi32

OpenServiceA QueryServiceStatus ControlService CloseServiceHandle RegQueryValueA RegOpenKeyExA RegSetValueExA RegCloseKey GetUserNameA OpenSCManagerA

shell32

SHGetFolderPathA ShellExecuteExA SHGetFileInfoA SHGetSpecialFolderPathA

ole32

CoCreateInstance CoInitialize

oleaut32

VariantClear VariantInit

mfc42

ord823 ord825

msvcrt

_strupr _stricmp _strcmpi _strnicmp exit fprintf sscanf getenv _adjust_fdiv _initterm _onexit __dllonexit ??1type_info@@UAE@XZ _beginthreadex _iob _errno realloc strchr wcstombs vsprintf sprintf ceil _ftol __CxxFrameHandler _CxxThrowException free malloc _except_handler3 strstr strncpy strrchr memmove _local_unwind2 rand printf atoi strcspn

urlmon

URLDownloadToFileA

ws2_32

inet_ntoa recv send select __WSAFDIsSet recvfrom sendto gethostbyname connect inet_addr WSAStartup WSACleanup accept socket htons bind listen getsockname ntohs closesocket getpeername

msvcp60

?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z ?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?_Xran@std@@YAXXZ ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB

iphlpapi

GetAdaptersInfo GetIfTable

Name

.text

Size

460KB

Virtual Size

460KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rodata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rotext

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

244KB

Virtual Size

244KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

48KB

Virtual Size

472KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

029a981def8f0ac569f7239e7f1ff9954663d7302efa7848e610a71fe35202be.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

mfc42

msvcrt

urlmon

ws2_32

msvcp60

iphlpapi

generic