gh0strat | 567e4f6f3faebc0672fd9e25ba1be09efdc357bd8dd3e49d4e713bbf059469f0

Sharing

Copy URL Twitter E-mail

General

Target
567e4f6f3faebc0672fd9e25ba1be09efdc357bd8dd3e49d4e713bbf059469f0
Size 1.2MB
Sample260804-p9yjgsbc76
SHA256 567e4f6f3faebc0672fd9e25ba1be09efdc357bd8dd3e49d4e713bbf059469f0
MD5 e9eb22a455a901e1090e6cf242638601
SHA1 543703e432f04151e9bdd419e439259a36c9f28d
SHA512 d3656d6f760d44e4d896d8272376afc00ae18c84d502fa61ec296e5185ec166896454f1c278d7296774a561bc9081dae3ee951efa06ac507e8e5a8efee8a8276
SSDEEP 24576:1ceXIHWPjWz5uhianLacJDyJJ8M5WbUg/n3MtRAaoS1Dg:trkT0
TLSH
T191553A83F6B68CF3DBC90430DC6AD2B177347A1DA3F786727280E9D6B9B6151781520A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat gh0strat

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
567e4f6f3faebc0672fd9e25ba1be09efdc357bd8dd3e49d4e713bbf059469f0

File Explorer

567e4f6f3faebc0672fd9e25ba1be09efdc357bd8dd3e49d4e713bbf059469f0

.dll 1.2MB

567e4f6f3faebc0672fd9e25ba1be09efdc357bd8dd3e49d4e713bbf059469f0

IMPHASH 310008eb692c0fff17259830bfb8d229
SHA256 567e4f6f3faebc0672fd9e25ba1be09efdc357bd8dd3e49d4e713bbf059469f0
MD5 e9eb22a455a901e1090e6cf242638601
SHA1 543703e432f04151e9bdd419e439259a36c9f28d
SHA512 d3656d6f760d44e4d896d8272376afc00ae18c84d502fa61ec296e5185ec166896454f1c278d7296774a561bc9081dae3ee951efa06ac507e8e5a8efee8a8276
SSDEEP 24576:1ceXIHWPjWz5uhianLacJDyJJ8M5WbUg/n3MtRAaoS1Dg:trkT0
TLSH
T191553A83F6B68CF3DBC90430DC6AD2B177347A1DA3F786727280E9D6B9B6151781520A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Gh0st RAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

155937

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetModuleFileNameA TerminateProcess OpenProcess GetVersionExA TerminateThread GetTickCount GetCommandLineA FreeConsole GetCurrentProcessId GetConsoleProcessList AttachConsole GetWindowsDirectoryA WideCharToMultiByte MultiByteToWideChar GlobalSize QueryPerformanceFrequency QueryPerformanceCounter LoadLibraryW GlobalMemoryStatusEx GetSystemInfo WTSGetActiveConsoleSessionId ProcessIdToSessionId OpenEventA DuplicateHandle ResumeThread SetThreadPriority GetCurrentThread SetPriorityClass GetEnvironmentVariableA GetShortPathNameA ExpandEnvironmentStringsA CreateMutexA GetCurrentThreadId lstrcpyW WinExec Module32Next lstrcmpiA Module32First CreateRemoteThread GetProcessId GetPriorityClass GlobalMemoryStatus GetComputerNameA GetPrivateProfileStringA FileTimeToSystemTime CopyFileA lstrcpynA lstrcmpA SetEnvironmentVariableA CompareStringW CompareStringA FlushFileBuffers SetStdHandle GetOEMCP GetACP GetStringTypeW GetStringTypeA GetCPInfo IsBadCodePtr GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA GetStartupInfoA GetFileType GetStdHandle SetHandleCount HeapSize SetUnhandledExceptionFilter LCMapStringW LCMapStringA IsBadWritePtr HeapCreate HeapDestroy TlsGetValue SetLastError TlsFree TlsAlloc TlsSetValue RaiseException InterlockedIncrement InterlockedDecrement RtlUnwind MoveFileExA Beep DeviceIoControl GetVersion ExitProcess Process32First Process32Next CreateToolhelp32Snapshot MoveFileA SetFileAttributesA RemoveDirectoryA FindFirstFileA FindNextFileA FindClose GetLogicalDriveStringsA GetVolumeInformationA GetDiskFreeSpaceExA GetDriveTypeA lstrcatA CreateProcessA lstrcpyA CreateDirectoryA GetLastError DeleteFileA GetCurrentProcess IsWow64Process SetFilePointer WriteFile GetProcAddress LocalSize GetSystemDirectoryA GetFileAttributesA CreateFileA GetFileSize ReadFile lstrlenA LocalReAlloc Sleep LocalAlloc LocalFree FreeLibrary IsBadReadPtr VirtualProtect HeapReAlloc HeapAlloc GetProcessHeap HeapFree CancelIo SetEvent ResetEvent CreateEventA GetModuleHandleA GetLocalTime GlobalAlloc GlobalLock GlobalFree GlobalUnlock CreateThread VirtualAlloc EnterCriticalSection LeaveCriticalSection VirtualFree DeleteCriticalSection InitializeCriticalSection InterlockedExchange WaitForSingleObject CloseHandle LoadLibraryA SystemTimeToTzSpecificLocalTime

user32

PostMessageA GetClipboardData OpenClipboard EmptyClipboard SetClipboardData SetCapture WindowFromPoint SetCursorPos GetCursorInfo GetCursorPos SetRect SendMessageA DispatchMessageA TranslateMessage IsDialogMessageA GetMessageA SetWindowPos GetDlgItem CreateDialogIndirectParamA SetDlgItemTextA GetDesktopWindow GetWindowTextLengthA SetFocus GetDlgItemTextA GetInputState SetClassLongA LoadIconA SetWindowLongA PostQuitMessage GetWindowLongA ShowWindow wsprintfA CharNextA GetWindowTextA GetForegroundWindow GetAsyncKeyState GetKeyState MessageBoxA EnumWindows ExitWindowsEx SwapMouseButton GetWindowRect MoveWindow FindWindowA ChangeDisplaySettingsA GetSystemMetrics GetDC LoadCursorA DestroyCursor BlockInput SetWindowTextA GetWindowThreadProcessId IsWindowVisible GetClassNameA GetWindow SetThreadDesktop GetUserObjectInformationA GetThreadDesktop CloseDesktop OpenInputDesktop PostThreadMessageA DestroyWindow WaitForInputIdle ReleaseDC SystemParametersInfoA keybd_event MapVirtualKeyA mouse_event CloseClipboard

gdi32

SelectObject CreateDIBSection CreateCompatibleDC DeleteObject DeleteDC GetRegionData CombineRgn CreateRectRgnIndirect GetDIBits CreateCompatibleBitmap BitBlt GetDeviceCaps

advapi32

RegEnumValueA InitializeSecurityDescriptor SetSecurityDescriptorDacl DeleteService SetServiceStatus OpenSCManagerA OpenServiceA CloseServiceHandle StartServiceA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegCreateKeyA RegSetValueExA OpenEventLogA ClearEventLogA CloseEventLog CreateProcessAsUserA GetUserNameA RegOpenKeyExA RegQueryValueA RegCloseKey LookupAccountSidA AbortSystemShutdownA RegOpenKeyA CreateServiceA ChangeServiceConfig2A StartServiceCtrlDispatcherA RegisterServiceCtrlHandlerExA DuplicateTokenEx SetTokenInformation GetTokenInformation RegEnumKeyExA RegQueryValueExA RegDeleteValueA RegDeleteKeyA RegCreateKeyExA RegQueryInfoKeyA UnlockServiceDatabase ChangeServiceConfigA LockServiceDatabase ControlService QueryServiceStatus QueryServiceConfig2A QueryServiceConfigA EnumServicesStatusA

shell32

SHGetFileInfoA ShellExecuteA ShellExecuteExA SHGetFolderPathA SHGetSpecialFolderPathA

ole32

CoInitialize CoCreateInstance CoUninitialize CoCreateGuid

oleaut32

SysFreeString

winmm

waveInGetNumDevs mciSendStringA

ws2_32

gethostname WSAStartup select recv WSAIoctl setsockopt connect htons gethostbyname ioctlsocket __WSAFDIsSet recvfrom sendto socket accept getpeername bind getsockname inet_addr listen ntohs inet_ntoa WSACleanup send closesocket

iphlpapi

GetIfTable

dwmapi

ord102 DwmIsCompositionEnabled

shlwapi

SHDeleteKeyA

netapi32

NetUserDel NetUserAdd NetLocalGroupAddMembers NetUserEnum NetUserGetInfo NetApiBufferFree NetUserGetLocalGroups NetUserSetInfo

psapi

GetProcessMemoryInfo GetModuleFileNameExA

wininet

InternetOpenA InternetReadFile HttpQueryInfoA HttpSendRequestA HttpOpenRequestA InternetCloseHandle InternetConnectA

wtsapi32

WTSQueryUserToken WTSEnumerateSessionsA WTSQuerySessionInformationW WTSDisconnectSession WTSLogoffSession WTSQuerySessionInformationA WTSFreeMemory

Name

.text

Size

625KB

Virtual Size

628KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rodata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rotext

Size

108KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

255KB

Virtual Size

256KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

261KB

Virtual Size

520KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

13KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=12, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=75, productName=Unmarked objects (old),

count=5, id=12, version=7291,

count=10, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=33, id=14, version=7299,

count=137, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=3, id=11, version=8047,

count=4, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=31, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=374, id=1, productName=Unmarked objects,

count=59, id=48, version=9044,

count=31, id=49, version=9044,

count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,

count=2, id=18, version=8444,

count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,