gh0strat | jaffacakes118_c103514eb8d4f60d2d039c1ca3ec5887a67533d2da11f1928f961b4b4ebbd5dc[.]bin

resource	yara_rule
sample	family_gh0strat
static1/unpack001/.rsrc/0/BIN/DLL	family_gh0strat

resource
jaffacakes118_c103514eb8d4f60d2d039c1ca3ec5887a67533d2da11f1928f961b4b4ebbd5dc.bin
unpack001/.rsrc/0/BIN/DLL

jaffacakes118_c103514eb8d4f60d2d039c1ca3ec5887a67533d2da11f1928f961b4b4ebbd5dc.bin

SHA256 c103514eb8d4f60d2d039c1ca3ec5887a67533d2da11f1928f961b4b4ebbd5dc
MD5 314d0658a0811a39cf79e9de6547fcf5
SHA1 81169362937605cc506f61e964631841c5bf28b8
SHA512 3f5e5556c98978138c3520d3777e319c9656686c5e323c6f445c63466299db7b2f8f88be80477b6ac3fa4ae6cc4d15edef66d23198c09c4151d534db89007f99
SSDEEP 3072:BeyQuWBtlGwY5dUOMMs5yXei+Tx5vkIhnTsgku1Q8M:BeyQuYg5CosE/IhnTsPu1
TLSH
T1FAD37C02B98580FEE5AC113C68BB7735963FB990C6986F87AF54FD7808B31609B17346
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Gh0st RAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10834

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

.rdata

SHA256 266f49f972f3479f093891549c1e074354935cdde88c20df30223f6c398baedc
MD5 56d60d0927fe44041ab23bcbdb501ce5
SHA1 7f34444ac7792d623af5b4b335ee8651dc33914a
SHA512 d00fa61fdd29a215b13fcf4a7dcaea063a8d987f3e93af50384fa46d6cde6ac61d9abf7520c7e295483841746bda2b6bd858654fb3a86b5b09f9f2196a86248f
SSDEEP 96:xas7BJRSTfuIy7TUKOYJtw/n/Wkvkm/uN4Mny+vk6GwMWI0Zh9uMWHr:/QWUaAPvkmE4MnyQkzwMWI0Z6MWHr
TLSH
T111C1E767984878F3C283F37A48716555EF83B3528739425B42F138BF85FE5C24D1A219
MD5 SHA1 SHA512 SSDEEP TLSH

Gh0st RAT payload

.rsrc/0/BIN/DLL

IMPHASH dd2b2aeb1e616ba965f94d0d3b28d29a
SHA256 076bf2fc2addef810fc8d0a26d623d493666339154158d33f81e4a4e9854bac5
MD5 b48ac1d13f29c5cf42fdd9bb82813df4
SHA1 7d12fcad154ebde50cbbe276d043702bc800917d
SHA512 8ee2a2d7468e7e680fbef7d6dc8a4cd2f553e7806af716c35e30365e15ad06a1263d9c93b4a32ef6feef99e8842e8bea32d481f5b2bc73c5c180b3fb931fe0db
SSDEEP 3072:ZBtlGwY5dUOMMs5yXei+Tx5vkIhnTsgku1Q8m:pg5CosE/IhnTsPu1W
TLSH
T186C36C01B99580FEE5AC153C78EB3B39963F6594CAD86FC7AF14DD7408A3120A727386
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Gh0st RAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

35653

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

WaitForSingleObject SetEvent ResumeThread CreateThread InitializeCriticalSection DeleteCriticalSection VirtualFree LeaveCriticalSection EnterCriticalSection VirtualAlloc ResetEvent lstrcpyA InterlockedExchange CancelIo Sleep lstrlenA GetPrivateProfileSectionNamesA lstrcatA GetWindowsDirectoryA FreeLibrary GetProcAddress LoadLibraryA MultiByteToWideChar WideCharToMultiByte lstrcmpA GetPrivateProfileStringA GetVersionExA DeleteFileA GetLastError CreateDirectoryA GetFileAttributesA CreateProcessA GetDriveTypeA GetDiskFreeSpaceExA GetVolumeInformationA GetLogicalDriveStringsA FindClose LocalFree FindNextFileA LocalReAlloc FindFirstFileA LocalAlloc RemoveDirectoryA GetFileSize CreateFileA ReadFile SetFilePointer TerminateThread MoveFileA GetModuleFileNameA SetLastError GetSystemDirectoryA GetCurrentProcess CreateRemoteThread WriteProcessMemory VirtualAllocEx OpenProcess MoveFileExA GetLocalTime ExpandEnvironmentStringsA GetTickCount HeapFree GetProcessHeap MapViewOfFile CreateFileMappingA HeapAlloc UnmapViewOfFile GlobalFree GlobalUnlock GlobalLock GlobalAlloc GlobalSize GetStartupInfoA CreatePipe DisconnectNamedPipe TerminateProcess PeekNamedPipe WaitForMultipleObjects GlobalMemoryStatusEx DeviceIoControl OutputDebugStringA GetSystemInfo ReleaseMutex OpenEventA SetErrorMode CreateMutexA SetUnhandledExceptionFilter FreeConsole LocalSize Process32Next Process32First CreateToolhelp32Snapshot lstrcmpiA GetCurrentThreadId RaiseException CloseHandle WriteFile CreateEventA

msvcrt

strncmp _errno wcscpy strncat realloc atol wcstombs atoi calloc ??1type_info@@UAE@XZ _initterm _adjust_fdiv strncpy strrchr _except_handler3 free malloc strchr _CxxThrowException strstr _ftol _beginthreadex ceil memmove __CxxFrameHandler ??3@YAXPAX@Z ??2@YAPAXI@Z _strnicmp _strcmpi

msvcp60

?_Xran@std@@YAXXZ ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB

avicap32

capGetDriverDescriptionA capCreateCaptureWindowA

Name

76

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

3

Size

1024B

Virtual Size

944B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

12316

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

99

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

1236

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

1231

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

9

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

1336

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

6123

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

61234

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

.rsrc/2052/BITMAP/108.bmp

SHA256 7d2554b478d88c0bd3479459ff4911163696feb5d67def57b4da2ab3b349ca5b
MD5 2322b000f4dd1e114c8001fb36d47818
SHA1 86513e2e04b621530e30888fa0d8fc26cf1302f3
SHA512 acb89c1a1f947f00d6ca940b9b530421b3fc5b87b380c7c3a0194af32f233346b52b0896745bd891300a4397f118af4c37c8c64c7a5abd34f390d058163f170d
TLSH
T1D8C00913A528C8E4D2001134C857BEA90E38BD839944020723B1EE5EBCB4EC464A6257
MD5 SHA1 SHA512 TLSH

Gh0st RAT payload

.rsrc/2052/CURSOR/2

SHA256 519122f5886bcca7e78f1537961c526d3128675006ed0c04b459ac49409176be
MD5 d0b80e255c29cea5d94bedb92ab4cb27
SHA1 c788f6312d7306d74d7173dc38c1d1e95a068d36
SHA512 ed7b23c6c7bcfe7150d3b905fca68e7d5896932609ed4649d99107d159ed3860c954ee508c6e18619e8c419fedde5785bc6fe059eef57149a76e80323e6ac9de
MD5 SHA1 SHA512

Gh0st RAT payload

.rsrc/2052/DIALOG/106

SHA256 96e3d5cf15f4ad9ae0abe2c55e485b7b9a072ae4748f0f58f9ee9cf8498de1d2
MD5 c18b837117974ab40e74276618dc4ae2
SHA1 565e96de53ef88d1472b0154d40e3897ffe4854b
SHA512 18b79a30b5cdd79faf5402d0cfa0532494f78a507273e8629556e7cfa300309681604ca342b4349fdbc0db5495ef565512fb27263bcb04eaf3a9cba32bba4c4f
TLSH
T145B0122443888718DC32837E5C3A8180BFB0F8A05B4783498081B90D0035E48FC50615
MD5 SHA1 SHA512 TLSH

Gh0st RAT payload

.rsrc/2052/GROUP_CURSOR/111

SHA256 b07e022f8ef0a8e5fd3f56986b2e5bf06df07054e9ea9177996b0a6c27d74d7c
MD5 aff0f5e372bd49ceb9f615b9a04c97df
SHA1 e3205724d7ee695f027ab5ea8d8e1a453aaad0dd
SHA512 01c375cd931742f8604b5de6b519d1ce6b32de16a0df91cf8549902d3a922e2d4741064ca3bde5b0fe2fd25198ba8510d06a6750fe16cbc84ec94a792cd47c45
MD5 SHA1 SHA512

Gh0st RAT payload

.rsrc/2052/GROUP_ICON/105

SHA256 404e02d011bc669c67ead03b175f7eaab8a01e00c044f6aed26dc0fb1ffef4f5
MD5 78bb727f88e9a797284b4261136ce56b
SHA1 5ed1d3100502c999ae46a84582b2978c9a4b4802
SHA512 03c6330c230ad70cef010bca657ba0e51b7a6e6c160e7bd475ffbd6959d9f39d8d52ce273bbce0f46b133355933e774133038d2be11759f60c7dcead1792add0
MD5 SHA1 SHA512

Gh0st RAT payload

.rsrc/2052/ICON/1.ico

SHA256 21b026c2742c9ad0dce1e0669833a7929bfcc816a9952fbb67846a1369bca270
MD5 e19f3a0e8aa99f2fabd86ece26b093db
SHA1 195b1936f54f31509ba7238b98b8b87485bbe9b2
SHA512 664cf6bb1fd3bd10331478a6933cfc46d89f8c25c2de1477e0025c9622eea5ed90a6ebdb4cd25ecd8e8b6532f74c8295d3652d8120d3acbc0ed4099a54dc09e2
TLSH
T13E21428866B5F8DCC44183389531FB32F1A0B25168CC911C892EFF0A79E58651807E43
MD5 SHA1 SHA512 TLSH

Gh0st RAT payload

.rsrc/2052/MANIFEST/1

SHA256 35b7d03732d6f5834ca165995ac2985880c2ac0c13b0d9c60a23edc9e0ae11e3
MD5 3094519c13cf5858434d62962a7658c1
SHA1 e86d3c8fd3cc71adc15e9b51ef5b30cc0921e275
SHA512 b2170898588303d5c858502fc12c8d8412b088bd1ed1b2d6242183db3e8e6c7de8f0c1480a292f481fae2b7ba189f16ceeb8ac63e8c2e9c79da0f1696fd37428
TLSH
T168F0C001D080FE3A9B2706A13FDDF41123AD933305CC069E4CE2F86AAF4B6CA06111B2
MD5 SHA1 SHA512 TLSH

Gh0st RAT payload

.rsrc/2052/MENU/107

SHA256 0717dfca923df0beca176f2cb47bdf066cd80d7365dac55184d1a6282bb81b26
MD5 00067feb6f81dcd6320fa75d91cc78f4
SHA1 c1cee2e3274e9de4b959a8d97448949a4a185d93
SHA512 6ad6503fcd3f5f1d1ba67dd81fe9107be3f8c572328565343ba77e6bf77093d3bd533b473db557fb0c2f899777e745894a59775ea126d2df8a69609987755687
MD5 SHA1 SHA512

Gh0st RAT payload

.rsrc/2052/string.txt

SHA256 864bf0beb4a56603a7180b6113a33536f78b2e3b52c1fd379e845b4cdd6e4716
MD5 a55fa94258be5c45892d0a49a10de489
SHA1 29440fbf786a88de8d8b2ea76e903d36f3a41fd3
SHA512 462752bd1f1d1fcbcb409a0242a9a72160277089e84efa4f775acfacb183e54a1e866246029a13d487ee5537ce46f952305fed4f677089566007629d05aaa07e
MD5 SHA1 SHA512

Gh0st RAT payload

.rsrc/2052/version.txt

SHA256 fa208cbc9fec168395acf77bc176d73aaa6f75fd451800e6986b5336a97e38f1
MD5 8330870a73266987f17547edb4a8cd30
SHA1 67ea4b8fa98c8cac26e0e5412dee65c3e6080a7b
SHA512 d1c7215fe64ad47c91ef611ac421f3b0a4218cdb961a45ed349e948d76d798c535d7ec4fe7cbcfc97d43cc2df6f2ade780d9a971b006fa54995c46d1a92755b4
TLSH
T13631C10A91EB359DA0BBA64D5AFACD3543473912043D965ED8CC3E8E0FD300429117F3
MD5 SHA1 SHA512 TLSH

Gh0st RAT payload

.rsrc_1

SHA256 29f9f39f2c1a8937b209c2a4a2a25520d045a8bcb65612198c9170c300442944
MD5 38b1c0977286e1efdc75d6bd9b117e19
SHA1 63ba52a07d68189bf7c93a7e9c65f3b2161f7ee4
SHA512 02a8c02570da286f7cc57f9df68159e5cdd71b5b7c0c3d266343e8350b312f0c28c78757463ca304daf658fd8a3acb767336dec9174b6fc68bc3f684f1999bcd
MD5 SHA1 SHA512

Gh0st RAT payload

.xdata

SHA256 b57a72d03143742ec7683866f467530b0c6cde964365c442fc4796cba7ec1c45
MD5 711104dd1cd6e00520d2b56d9cb487af
SHA1 2f7a30d8658e789aa9df6693339abed0898043db
SHA512 4ed0ed64118ba619e9b13016e8d892a20dcf64ffe7ed15d7b23f734d0adacb757a855603b7e7883176eae4e375306993bff816152be7572f81b6207a5aab6a28
TLSH
T110F0014BF3AEC0E6D69105311C4AD7CD26A3B330DE25464B3AF9439FAC302D04E5A650
MD5 SHA1 SHA512 TLSH

Gh0st RAT payload

0

SHA256 a19fb3d88ca207220b80d42dfb3625fb118f648daec408041c3cd15805668cab
MD5 3d1a1b6e2a6c6229747da5a5d7307354
SHA1 cb2530dfcd67db6f7da3a5996300f6e431b57b84
SHA512 2b9be1b8d1934092d675ae6527d2028cc3df624c99d0082e9296a4c07d043ad8a42d97a795bd8911e55b9f66df58558fc5bfb33eee41c509975ece5d1a7cfaeb
TLSH
T16751A42BCE4554E0E9490231C83E473AEEB75571276DA4A28376F498EBB6A83D02501F
MD5 SHA1 SHA512 TLSH

Gh0st RAT payload

jaffacakes118_c103514eb8d4f60d2d039c1ca3ec5887a67533d2da11f1928f961b4b4ebbd5dc.bin

generic

.rdata

.rsrc/0/BIN/DLL

kernel32

msvcrt

msvcp60

avicap32

generic

.rsrc/2052/BITMAP/108.bmp

.rsrc/2052/CURSOR/2

.rsrc/2052/DIALOG/106

.rsrc/2052/GROUP_CURSOR/111

.rsrc/2052/GROUP_ICON/105

.rsrc/2052/ICON/1.ico

.rsrc/2052/MANIFEST/1

.rsrc/2052/MENU/107

.rsrc/2052/string.txt

.rsrc/2052/version.txt

.rsrc_1

.xdata

0

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_c103514eb8d4f60d2d039c1ca3ec5887a67533d2da11f1928f961b4b4ebbd5dc.bin

generic

.rdata

.rsrc/0/BIN/DLL

kernel32

msvcrt

msvcp60

avicap32

generic

.rsrc/2052/BITMAP/108.bmp

.rsrc/2052/CURSOR/2

.rsrc/2052/DIALOG/106

.rsrc/2052/GROUP_CURSOR/111

.rsrc/2052/GROUP_ICON/105

.rsrc/2052/ICON/1.ico

.rsrc/2052/MANIFEST/1

.rsrc/2052/MENU/107

.rsrc/2052/string.txt

.rsrc/2052/version.txt

.rsrc_1

.xdata

0