gh0strat | jaffacakes118_Trojan-GameThief[.]Win32[.]Magania[.]cqbs[.]2edf679ed7afde57581e79c0e713a070

General

Target
jaffacakes118_Trojan-GameThief.Win32.Magania.cqbs.2edf679ed7afde57581e79c0e713a070
Size 107KB
Sample261006-txtf8aay2v
SHA256 2e8ffc64b8b47d39f1147be1ce49ca17ded9be1b12cbe2ad29ff58208ba5f604
MD5 2edf679ed7afde57581e79c0e713a070
SHA1 c5b4807b47cc765b5901f734744edebc1040ffa0
SHA512 41d81d98769a76735718a82c4b18e84afabd80ae5e3f68e4f93fc198574ac3db2464a96c953314dbec5998fa9a301737194938cfea2a906a4ff6ec53dbc1552b
SSDEEP 3072:oHSy4YKkDTNHwSMbpaXDH99BA85oOYofTw+0knoNU90I:oHSy4xkHNHwSMb8x9KtORLw+znoOT
TLSH
T15EB37E01FAC240FFE6A8153C14BB7B35EA3FB9659B196F833318DA550D622419F22396
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat gh0strat

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan-GameThief.Win32.Magania.cqbs.2edf679ed7afde57581e79c0e713a070

File Explorer

jaffacakes118_Trojan-GameThief.Win32.Magania.cqbs.2edf679ed7afde57581e79c0e713a070

.exe 107KB

jaffacakes118_Trojan-GameThief.Win32.Magania.cqbs.2edf679ed7afde57581e79c0e713a070

IMPHASH b5e0666c0d1aa8280c7574abf572417e
SHA256 2e8ffc64b8b47d39f1147be1ce49ca17ded9be1b12cbe2ad29ff58208ba5f604
MD5 2edf679ed7afde57581e79c0e713a070
SHA1 c5b4807b47cc765b5901f734744edebc1040ffa0
SHA512 41d81d98769a76735718a82c4b18e84afabd80ae5e3f68e4f93fc198574ac3db2464a96c953314dbec5998fa9a301737194938cfea2a906a4ff6ec53dbc1552b
SSDEEP 3072:oHSy4YKkDTNHwSMbpaXDH99BA85oOYofTw+0knoNU90I:oHSy4xkHNHwSMb8x9KtORLw+znoOT
TLSH
T15EB37E01FAC240FFE6A8153C14BB7B35EA3FB9659B196F833318DA550D622419F22396
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Gh0st RAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

9682

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentThreadId GetCommandLineA Sleep SetUnhandledExceptionFilter GetModuleFileNameA ExpandEnvironmentStringsA DeleteFileA GetFileAttributesA SetLastError lstrcmpiA lstrlenA lstrcpyA FindResourceA LoadResource LockResource SizeofResource HeapFree GetSystemDirectoryA MultiByteToWideChar WideCharToMultiByte ExitProcess lstrcatA GetLastError GetProcessHeap HeapAlloc GetModuleHandleA GetProcAddress GetStartupInfoA

user32

GetInputState PostThreadMessageA wsprintfA GetMessageA

advapi32

CloseServiceHandle GetUserNameA RegCreateKeyExA RegSetValueExA RegDeleteKeyA RegDeleteValueA RegQueryValueExA RegOpenKeyExA RegCloseKey LookupAccountNameA GetFileSecurityA InitializeSecurityDescriptor GetSecurityDescriptorDacl GetAclInformation GetLengthSid InitializeAcl AddAce GetAce EqualSid AddAccessAllowedAce SetSecurityDescriptorDacl GetSecurityDescriptorControl SetFileSecurityA OpenSCManagerA OpenServiceA StartServiceA CreateServiceA

msvcrt

_XcptFilter _controlfp _except_handler3 strchr fclose fwrite fopen ??2@YAPAXI@Z __CxxFrameHandler _CxxThrowException strstr ??3@YAXPAX@Z ??1type_info@@UAE@XZ _exit exit _acmdln __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type

netapi32

NetUserGetLocalGroups NetApiBufferFree

Sharing