gh0strat | EA042785385F78E162DCC66FF447B858[.]dll

Sharing

Copy URL Twitter E-mail

General

Target
EA042785385F78E162DCC66FF447B858.dll
Size 14.8MB
Sample250525-ryrynssms3
SHA256 8cd0a1d8e18cc3adee5fa5c4293b7bb89be489c3d9a98f2afb4bb1ea840a4163
MD5 ea042785385f78e162dcc66ff447b858
SHA1 556b15f7e04a92e623b4c12e4e979dad815cfed7
SHA512 3a6c6cfe4e906ab8829310da477973a7e566aec9bda7d6707fb421063c14f07b5f4e41d73d99e0fd21bd31db7ea2f9fcfd31d03e0175688b04fda050c8550dc2
SSDEEP 12288:s6+4ClFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFj:sL4Cv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
EA042785385F78E162DCC66FF447B858.dll

File Explorer

EA042785385F78E162DCC66FF447B858.dll

.dll 14.8MB

EA042785385F78E162DCC66FF447B858.dll

IMPHASH 23c4cac4f5148bd624211e44dcd1d8b7
SHA256 8cd0a1d8e18cc3adee5fa5c4293b7bb89be489c3d9a98f2afb4bb1ea840a4163
MD5 ea042785385f78e162dcc66ff447b858
SHA1 556b15f7e04a92e623b4c12e4e979dad815cfed7
SHA512 3a6c6cfe4e906ab8829310da477973a7e566aec9bda7d6707fb421063c14f07b5f4e41d73d99e0fd21bd31db7ea2f9fcfd31d03e0175688b04fda050c8550dc2
SSDEEP 12288:s6+4ClFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFj:sL4Cv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Gh0st RAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

80778

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

LocalReAlloc FindFirstFileA LocalAlloc GetFileSize ReadFile SetFilePointer MoveFileA lstrcatA CreateProcessA Process32Next lstrcmpiA Process32First CreateToolhelp32Snapshot HeapFree MapViewOfFile CreateFileMappingA UnmapViewOfFile GetModuleHandleA GlobalFree GlobalUnlock GlobalLock FindClose GlobalSize GetStartupInfoA WaitForMultipleObjects LocalSize TerminateProcess OpenProcess GetCurrentThreadId GlobalMemoryStatus GetSystemInfo GetComputerNameA GetVersionExA OpenEventA SetErrorMode CreateMutexA FindNextFileA GetWindowsDirectoryA SetFileAttributesA CopyFileA ExpandEnvironmentStringsA GetModuleFileNameA CreateFileA GetLogicalDriveStringsA GetVolumeInformationA GetDiskFreeSpaceExA GetDriveTypeA lstrlenA lstrcpyA GetFileAttributesA CreateDirectoryA DeleteFileA GetProcessHeap HeapAlloc GetCurrentProcessId GetLocalTime GetTickCount CancelIo InterlockedExchange ResetEvent GetLastError VirtualAlloc EnterCriticalSection LeaveCriticalSection VirtualFree DeleteCriticalSection CreateThread ResumeThread SetEvent WaitForSingleObject Sleep TerminateThread GetCurrentProcess LocalFree CloseHandle FreeLibrary LoadLibraryA GlobalAlloc GetProcAddress

user32

LoadMenuA RegisterClassA LoadIconA CreateWindowExA CloseWindow IsWindow PostMessageA OpenDesktopA GetThreadDesktop GetUserObjectInformationA OpenInputDesktop SetThreadDesktop IsWindowVisible GetWindowThreadProcessId ExitWindowsEx GetCursorPos GetCursorInfo DestroyCursor ReleaseDC GetDesktopWindow GetDC SetRect GetSystemMetrics GetClipboardData OpenClipboard EmptyClipboard SetClipboardData CloseClipboard mouse_event SetCursorPos WindowFromPoint SetCapture DispatchMessageA TranslateMessage GetMessageA CharNextA wsprintfA GetWindowTextA MessageBoxA LoadCursorA BlockInput SendMessageA keybd_event MapVirtualKeyA CloseDesktop

gdi32

GetStockObject

advapi32

OpenProcessToken RegDeleteKeyA RegRestoreKeyA RegSaveKeyA RegCloseKey RegQueryValueExA RegOpenKeyExA CloseEventLog ClearEventLogA OpenEventLogA RegSetValueExA RegCreateKeyExA CloseServiceHandle DeleteService OpenServiceA OpenSCManagerA FreeSid SetSecurityDescriptorDacl AddAccessAllowedAce InitializeAcl GetLengthSid AllocateAndInitializeSid InitializeSecurityDescriptor RegOpenKeyA SetServiceStatus RegisterServiceCtrlHandlerA UnlockServiceDatabase ChangeServiceConfig2A LockServiceDatabase CreateServiceA StartServiceA AdjustTokenPrivileges LookupPrivilegeValueA

shell32

SHGetSpecialFolderPathA

msvcrt

sprintf strncpy free malloc _except_handler3 strrchr _beginthreadex atoi rand _access srand calloc ??1type_info@@UAE@XZ _initterm _adjust_fdiv _CxxThrowException _stricmp strstr _ftol ??2@YAPAXI@Z ??3@YAXPAX@Z puts __CxxFrameHandler memmove putchar wcstombs _strrev ceil

ws2_32

sendto WSASocketA htonl getsockname inet_addr send closesocket select recv socket gethostbyname htons setsockopt WSAIoctl WSACleanup WSAStartup connect

msvcp60

?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?_Xran@std@@YAXXZ ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z