gh0strat | 46cf7cb062990aac2748b236b58c8940d53d882e1c92b06cf753112bd33b23c1

Sharing

Copy URL Twitter E-mail

General

Target
46cf7cb062990aac2748b236b58c8940d53d882e1c92b06cf753112bd33b23c1
Size 1.1MB
Sample260907-k925fstbrc
SHA256 46cf7cb062990aac2748b236b58c8940d53d882e1c92b06cf753112bd33b23c1
MD5 194a83328288451b59243e9de52a6e48
SHA1 c40db2b5183f21552f7bc708e608f8d1168a585e
SHA512 3cc3c91e2195a5aa9718aa93eb10b27437b45c743a04a2b9ea439e1618eb25734288c8609027dd3dd066a86224fc5facd2aedf6fbf5604f7572ceed49f2e0ac8
SSDEEP 24576:XceXIHWPjWz5uhianLacJDyJJ8M5WbUg/n3MtRAaoS1Vgx:jrkTOx
TLSH
T148353A83F6B68CF7DBC90434DC6AE27177347A1D93FB86327280E9D6B8B6151781424A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat gh0strat

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
46cf7cb062990aac2748b236b58c8940d53d882e1c92b06cf753112bd33b23c1

File Explorer

46cf7cb062990aac2748b236b58c8940d53d882e1c92b06cf753112bd33b23c1

.dll 1.1MB

46cf7cb062990aac2748b236b58c8940d53d882e1c92b06cf753112bd33b23c1

IMPHASH 310008eb692c0fff17259830bfb8d229
SHA256 46cf7cb062990aac2748b236b58c8940d53d882e1c92b06cf753112bd33b23c1
MD5 194a83328288451b59243e9de52a6e48
SHA1 c40db2b5183f21552f7bc708e608f8d1168a585e
SHA512 3cc3c91e2195a5aa9718aa93eb10b27437b45c743a04a2b9ea439e1618eb25734288c8609027dd3dd066a86224fc5facd2aedf6fbf5604f7572ceed49f2e0ac8
SSDEEP 24576:XceXIHWPjWz5uhianLacJDyJJ8M5WbUg/n3MtRAaoS1Vgx:jrkTOx
TLSH
T148353A83F6B68CF7DBC90434DC6AE27177347A1D93FB86327280E9D6B8B6151781424A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Gh0st RAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

155937

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetModuleFileNameA TerminateProcess OpenProcess GetVersionExA TerminateThread GetTickCount GetCommandLineA FreeConsole GetCurrentProcessId GetConsoleProcessList AttachConsole GetWindowsDirectoryA WideCharToMultiByte MultiByteToWideChar GlobalSize QueryPerformanceFrequency QueryPerformanceCounter LoadLibraryW GlobalMemoryStatusEx GetSystemInfo WTSGetActiveConsoleSessionId ProcessIdToSessionId OpenEventA DuplicateHandle ResumeThread SetThreadPriority GetCurrentThread SetPriorityClass GetEnvironmentVariableA GetShortPathNameA ExpandEnvironmentStringsA CreateMutexA GetCurrentThreadId lstrcpyW WinExec Module32Next lstrcmpiA Module32First CreateRemoteThread GetProcessId GetPriorityClass GlobalMemoryStatus GetComputerNameA GetPrivateProfileStringA FileTimeToSystemTime CopyFileA lstrcpynA lstrcmpA SetEnvironmentVariableA CompareStringW CompareStringA FlushFileBuffers SetStdHandle GetOEMCP GetACP GetStringTypeW GetStringTypeA GetCPInfo IsBadCodePtr GetEnvironmentStringsW GetEnvironmentStrings FreeEnvironmentStringsW FreeEnvironmentStringsA GetStartupInfoA GetFileType GetStdHandle SetHandleCount HeapSize SetUnhandledExceptionFilter LCMapStringW LCMapStringA IsBadWritePtr HeapCreate HeapDestroy TlsGetValue SetLastError TlsFree TlsAlloc TlsSetValue RaiseException InterlockedIncrement InterlockedDecrement RtlUnwind MoveFileExA Beep DeviceIoControl GetVersion ExitProcess Process32First Process32Next CreateToolhelp32Snapshot MoveFileA SetFileAttributesA RemoveDirectoryA FindFirstFileA FindNextFileA FindClose GetLogicalDriveStringsA GetVolumeInformationA GetDiskFreeSpaceExA GetDriveTypeA lstrcatA CreateProcessA lstrcpyA CreateDirectoryA GetLastError DeleteFileA GetCurrentProcess IsWow64Process SetFilePointer WriteFile GetProcAddress LocalSize GetSystemDirectoryA GetFileAttributesA CreateFileA GetFileSize ReadFile lstrlenA LocalReAlloc Sleep LocalAlloc LocalFree FreeLibrary IsBadReadPtr VirtualProtect HeapReAlloc HeapAlloc GetProcessHeap HeapFree CancelIo SetEvent ResetEvent CreateEventA GetModuleHandleA GetLocalTime GlobalAlloc GlobalLock GlobalFree GlobalUnlock CreateThread VirtualAlloc EnterCriticalSection LeaveCriticalSection VirtualFree DeleteCriticalSection InitializeCriticalSection InterlockedExchange WaitForSingleObject CloseHandle LoadLibraryA SystemTimeToTzSpecificLocalTime

user32

PostMessageA GetClipboardData OpenClipboard EmptyClipboard SetClipboardData SetCapture WindowFromPoint SetCursorPos GetCursorInfo GetCursorPos SetRect SendMessageA DispatchMessageA TranslateMessage IsDialogMessageA GetMessageA SetWindowPos GetDlgItem CreateDialogIndirectParamA SetDlgItemTextA GetDesktopWindow GetWindowTextLengthA SetFocus GetDlgItemTextA GetInputState SetClassLongA LoadIconA SetWindowLongA PostQuitMessage GetWindowLongA ShowWindow wsprintfA CharNextA GetWindowTextA GetForegroundWindow GetAsyncKeyState GetKeyState MessageBoxA EnumWindows ExitWindowsEx SwapMouseButton GetWindowRect MoveWindow FindWindowA ChangeDisplaySettingsA GetSystemMetrics GetDC LoadCursorA DestroyCursor BlockInput SetWindowTextA GetWindowThreadProcessId IsWindowVisible GetClassNameA GetWindow SetThreadDesktop GetUserObjectInformationA GetThreadDesktop CloseDesktop OpenInputDesktop PostThreadMessageA DestroyWindow WaitForInputIdle ReleaseDC SystemParametersInfoA keybd_event MapVirtualKeyA mouse_event CloseClipboard

gdi32

SelectObject CreateDIBSection CreateCompatibleDC DeleteObject DeleteDC GetRegionData CombineRgn CreateRectRgnIndirect GetDIBits CreateCompatibleBitmap BitBlt GetDeviceCaps

advapi32

RegEnumValueA InitializeSecurityDescriptor SetSecurityDescriptorDacl DeleteService SetServiceStatus OpenSCManagerA OpenServiceA CloseServiceHandle StartServiceA OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges RegCreateKeyA RegSetValueExA OpenEventLogA ClearEventLogA CloseEventLog CreateProcessAsUserA GetUserNameA RegOpenKeyExA RegQueryValueA RegCloseKey LookupAccountSidA AbortSystemShutdownA RegOpenKeyA CreateServiceA ChangeServiceConfig2A StartServiceCtrlDispatcherA RegisterServiceCtrlHandlerExA DuplicateTokenEx SetTokenInformation GetTokenInformation RegEnumKeyExA RegQueryValueExA RegDeleteValueA RegDeleteKeyA RegCreateKeyExA RegQueryInfoKeyA UnlockServiceDatabase ChangeServiceConfigA LockServiceDatabase ControlService QueryServiceStatus QueryServiceConfig2A QueryServiceConfigA EnumServicesStatusA

shell32

SHGetFileInfoA ShellExecuteA ShellExecuteExA SHGetFolderPathA SHGetSpecialFolderPathA

ole32

CoInitialize CoCreateInstance CoUninitialize CoCreateGuid

oleaut32

SysFreeString

winmm

waveInGetNumDevs mciSendStringA

ws2_32

gethostname WSAStartup select recv WSAIoctl setsockopt connect htons gethostbyname ioctlsocket __WSAFDIsSet recvfrom sendto socket accept getpeername bind getsockname inet_addr listen ntohs inet_ntoa WSACleanup send closesocket

iphlpapi

GetIfTable

dwmapi

ord102 DwmIsCompositionEnabled

shlwapi

SHDeleteKeyA

netapi32

NetUserDel NetUserAdd NetLocalGroupAddMembers NetUserEnum NetUserGetInfo NetApiBufferFree NetUserGetLocalGroups NetUserSetInfo

psapi

GetProcessMemoryInfo GetModuleFileNameExA

wininet

InternetOpenA InternetReadFile HttpQueryInfoA HttpSendRequestA HttpOpenRequestA InternetCloseHandle InternetConnectA

wtsapi32

WTSQueryUserToken WTSEnumerateSessionsA WTSQuerySessionInformationW WTSDisconnectSession WTSLogoffSession WTSQuerySessionInformationA WTSFreeMemory

Name

.text

Size

625KB

Virtual Size

628KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rodata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rotext

Size

108KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

255KB

Virtual Size

256KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

73KB

Virtual Size

520KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

13KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

26KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

generic

count=12, id=10, productName=VS98 (6.0) build 8168, version=8168,

count=2, id=123, productName=VS2005 build 50727, version=50727,

count=75, productName=Unmarked objects (old),

count=5, id=12, version=7291,

count=10, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=33, id=14, version=7299,

count=137, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,

count=3, id=11, version=8047,

count=4, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=31, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,

count=374, id=1, productName=Unmarked objects,

count=59, id=48, version=9044,

count=31, id=49, version=9044,

count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,

count=2, id=18, version=8444,

count=1, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,