gh0strat | jaffacakes118_Trojan-GameThief[.]Win32[.]Magania[.]ualj[.]20a94d41d1bdb84729b4080f5adc2780

resource	yara_rule
sample	family_gh0strat
static1/unpack001/.text	family_gh0strat

resource
jaffacakes118_Trojan-GameThief.Win32.Magania.ualj.20a94d41d1bdb84729b4080f5adc2780

jaffacakes118_Trojan-GameThief.Win32.Magania.ualj.20a94d41d1bdb84729b4080f5adc2780

IMPHASH 8c7c0aa97bd8d63cf70bf9af9a755a65
SHA256 44ba5431d31dd92d2beefe9741d1b235880f996781b26db084364d51719b124c
MD5 20a94d41d1bdb84729b4080f5adc2780
SHA1 ae6f44aac3beef00e6a1fbf95ac8cc16c40e8fc6
SHA512 6b25dc39b318d7866257832f89eefbc65fa5ed89ecc5d84f5abc2ad40317ef68867d3b852832d764b086033825e0bddde42013b13c13a290ebe0fa09beda0b47
SSDEEP 3072:PKIO+FY3VDkdrIPizmawGB9HFkJEa1QmqIpkuoZWRvkd:jY3Y0PqgKpqEOzqOWZWp
TLSH
T113E33A91BE9712FCF658123C0CAB2B3E512F6DDB07467A53B61CDA1104D3A70DA2762B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Gh0st RAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

104634

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetFilePointer MoveFileA CreateProcessA CreateThread InitializeCriticalSection Process32Next lstrcmpiA Process32First CreateToolhelp32Snapshot HeapFree MapViewOfFile CreateFileMappingA UnmapViewOfFile LocalSize GlobalFree GlobalUnlock GlobalLock ReadFile GlobalSize GetStartupInfoA WaitForMultipleObjects TerminateProcess OpenProcess GlobalMemoryStatus OpenEventA SetErrorMode GetCurrentProcess SetFileAttributesA WriteFile CreateFileA CopyFileA CreateEventA ExpandEnvironmentStringsA GetModuleFileNameA GetFileSize LocalAlloc FindFirstFileA LocalReAlloc FindNextFileA LocalFree FindClose GetLogicalDriveStringsA GetVolumeInformationA GetDiskFreeSpaceExA GetDriveTypeA GetFileAttributesA CreateDirectoryA DeleteFileA GetVersionExA GetPrivateProfileStringA lstrcmpA WideCharToMultiByte MultiByteToWideChar GetWindowsDirectoryA lstrcpyA lstrcatA GetPrivateProfileSectionNamesA lstrlenA GetProcessHeap HeapAlloc GetCurrentProcessId GetLocalTime GetTickCount CancelIo InterlockedExchange ResetEvent GetLastError VirtualAlloc EnterCriticalSection LeaveCriticalSection VirtualFree DeleteCriticalSection ResumeThread SetEvent WaitForSingleObject Sleep TerminateThread CloseHandle FreeLibrary LoadLibraryA GetProcAddress GlobalAlloc

user32

wsprintfA CharNextA GetWindowTextA MessageBoxA LoadCursorA BlockInput SendMessageA keybd_event MapVirtualKeyA SetCapture WindowFromPoint SetCursorPos mouse_event CloseClipboard GetMessageA EmptyClipboard OpenClipboard GetClipboardData GetSystemMetrics SetRect GetDC GetDesktopWindow ReleaseDC DestroyCursor GetCursorInfo GetCursorPos ExitWindowsEx GetWindowThreadProcessId LoadIconA RegisterClassA LoadMenuA TranslateMessage DispatchMessageA SetClipboardData CreateWindowExA CloseWindow IsWindow PostMessageA OpenDesktopA GetThreadDesktop GetUserObjectInformationA OpenInputDesktop SetThreadDesktop CloseDesktop IsWindowVisible

gdi32

GetStockObject

advapi32

GetLengthSid RegCloseKey RegQueryValueExA RegOpenKeyExA IsValidSid LookupAccountNameA LsaClose LsaRetrievePrivateData LsaOpenPolicy LsaFreeMemory CloseEventLog ClearEventLogA OpenEventLogA RegSetValueExA RegCreateKeyExA CloseServiceHandle DeleteService OpenServiceA OpenSCManagerA FreeSid SetSecurityDescriptorDacl AddAccessAllowedAce InitializeAcl AllocateAndInitializeSid InitializeSecurityDescriptor RegEnumKeyExA RegQueryInfoKeyA RegEnumValueA RegDeleteValueA RegDeleteKeyA RegRestoreKeyA RegSaveKeyA LookupAccountSidA GetTokenInformation OpenProcessToken RegOpenKeyA SetServiceStatus RegisterServiceCtrlHandlerA UnlockServiceDatabase ChangeServiceConfig2A LockServiceDatabase CreateServiceA StartServiceA AdjustTokenPrivileges LookupPrivilegeValueA

shell32

SHGetSpecialFolderPathA

msvcrt

_strcmpi _strrev _except_handler3 _strnicmp _adjust_fdiv _initterm ??1type_info@@UAE@XZ calloc srand _access wcstombs _beginthreadex wcscpy _errno strncmp atoi strrchr _stricmp free malloc strchr strncpy sprintf rand _CxxThrowException strstr _ftol ceil putchar memmove __CxxFrameHandler puts ??3@YAXPAX@Z ??2@YAPAXI@Z

ws2_32

getsockname bind getpeername accept listen recvfrom __WSAFDIsSet ntohs inet_ntoa htonl WSASocketA sendto connect inet_addr send closesocket select socket gethostbyname htons setsockopt WSAStartup WSACleanup WSAIoctl recv

msvcp60

?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?_Xran@std@@YAXXZ ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z

netapi32

NetUserAdd NetLocalGroupAddMembers

wtsapi32

WTSFreeMemory WTSQuerySessionInformationA

Name

.text

Size

100KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

winrar

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

.data

SHA256 6a61b9db6a28405332975354a1426c91634f7f154b2d0add8556a27c82304f6d
MD5 3fd9abdfdc75d43270be2acbf4f02f1c
SHA1 cc4c1b98ef10220df8c8b5b4663d361097cbee09
SHA512 566bc2bddd11b927049824eeeab03c04695b1941babae5c08111649d8cde46189518e612a03e71d73ed6f1603c675a4736c6057dfa807e01246c45f015a4c917
SSDEEP 192:/9swzV2sjkXUt7GJikjMqQYHl36IJ4lj+fzARyUeDA2fLe:VcgoC+fztUmT6
TLSH
T14722810E6F342BBDE133203309994F3B9876F088399E4E12BCAE954504566DD9F6B35D
MD5 SHA1 SHA512 SSDEEP TLSH

Gh0st RAT payload

.rdata

SHA256 bf6edbade23f0d85099be31e3bd0567d963a707340b0a8716c415470cbe8d5c2
MD5 e551babb6d286ef547e1d777de1125dc
SHA1 51fd273da3c39bfff53bdf55b910849449da4359
SHA512 eed3cfd31370d7a2e7b171308f2bf3e7337fe4dd05f0e1c58a4a17a36960c8eb8a6e08678ed3748451fbdc5a1cf160db21a930a8a3415863cefec7e829c19e96
SSDEEP 192:gYCnCCs3xq/6gEwJ7/v8R09zYCnCyU6oEnQRvZjKh/RtXG/RtZl7zG9DdaYIt/W+:Ue4i/e7/ky9RU67sc/RtXyZlu9Zg
TLSH
T18C528442B9A8D997D08D1370DCE7C77AA7B27448CEBE0E472588D78E1D592842F963F0
MD5 SHA1 SHA512 SSDEEP TLSH

Gh0st RAT payload

.reloc

SHA256 ddb4f808b6e9ee0af178555f2e1aef32bccc28e9978eb4c1b82d866e75af597c
MD5 5c9ecde49a1f0b115b7f64262a7503ff
SHA1 676265c6c60a35fc537f0a8c850afea33005e00b
SHA512 dc6ceb92dca8be649060fffccb251358ee3d91669f7f4b84802060f51e89938f1cf8c021a98de52540459da7799e3253a1b7e8aa98b3085d1b62df10c4e0349e
SSDEEP 96:6JEVjNZu5FPFCh4ANPwBxPqA5oz4nnTFJm19yUOUR05WQub/AIl97dQanhD7:6wNG0Oy8xPD5bTFJsU5SHTAIlFdQ
TLSH
T176C15B287032B8A9C93440BC3B0CBF5AE7DC94BFD1A51EBB49494BC6DDA26109DA9407
MD5 SHA1 SHA512 SSDEEP TLSH

Gh0st RAT payload

.rsrc/BITMAP/103.bmp

SHA256 ffabc504465994a50fed3bea2e5020ed46567be59cfa1628de1bdea07f220d27
MD5 66c3de780d6f3b1e5cd6cdcb8939acfe
SHA1 eb6d71711fc980f631f15ed6e57ba05edc9b5442
SHA512 7ade82bea19cdcf100b56d97152aaf2fd92efa5b27ffbb3ce2c64f94ff6b7532b2bc55a351442f6aba92fed715741289deeb18ac56951b6390dad0a8ea70172e
TLSH
T17FC001137168C994D20400318887CFBC0D387C839846020B27F1DF5FBCB4B646446155
MD5 SHA1 SHA512 TLSH

Gh0st RAT payload

.rsrc/MANIFEST/1

SHA256 35b7d03732d6f5834ca165995ac2985880c2ac0c13b0d9c60a23edc9e0ae11e3
MD5 3094519c13cf5858434d62962a7658c1
SHA1 e86d3c8fd3cc71adc15e9b51ef5b30cc0921e275
SHA512 b2170898588303d5c858502fc12c8d8412b088bd1ed1b2d6242183db3e8e6c7de8f0c1480a292f481fae2b7ba189f16ceeb8ac63e8c2e9c79da0f1696fd37428
TLSH
T168F0C001D080FE3A9B2706A13FDDF41123AD933305CC069E4CE2F86AAF4B6CA06111B2
MD5 SHA1 SHA512 TLSH

Gh0st RAT payload

.rsrc/MENU/102

SHA256 0717dfca923df0beca176f2cb47bdf066cd80d7365dac55184d1a6282bb81b26
MD5 00067feb6f81dcd6320fa75d91cc78f4
SHA1 c1cee2e3274e9de4b959a8d97448949a4a185d93
SHA512 6ad6503fcd3f5f1d1ba67dd81fe9107be3f8c572328565343ba77e6bf77093d3bd533b473db557fb0c2f899777e745894a59775ea126d2df8a69609987755687
MD5 SHA1 SHA512

Gh0st RAT payload

.rsrc/version.txt

SHA256 56f9f3cf94966575c98e037d43a004bfa11f87e01b1a4f86709b9a0ceb00112f
MD5 e660bb190fcc00765a442211801b51c8
SHA1 96bbb5b07b176d39e29a686708a12729ec9e1989
SHA512 dc82ae5ba80db41b04ea541578d329ff114841a465cf0a7adf61626d76f1e32a7db0e7ea04bf75a026ae77eabe84aa08a702a23040f81681040d331c7b769318
TLSH
T1C641BE0693FA3664F0F76A995EEA8D3647273914083CD25E98CC3E8D0FE380498217B3
MD5 SHA1 SHA512 TLSH

Gh0st RAT payload

.text

SHA256 720fface997afe32fb7994d1cec0d13e2680fdbd73ef0d46ad551f020bcc6d1a
MD5 55cdf17c7179037e6861b747cc042ea0
SHA1 e8c00b11b6308b0dbc1d22746afeb603fc5f0461
SHA512 a2e7f69a8cdca0cd44468b9f23bd16c76800c31c37baa0a2375a8f72923c2a33a3f999d1ba2c6e4da27f58e0c5068ddac9848d01797ba2f977b3846324585b49
SSDEEP 1536:GK0vtbSOSYFmaGSsV8gqmkdruxV1izma3y3xcxB9HFc/Jyfa1QGb:GKIO+FY3VDkdrIPizmawGB9HFkJEa1Q
TLSH
T168A3F9A1AE8712FCFA8816781CBA3B3D551F5DDB4742B653B71CDE1200D3A70942792B
MD5 SHA1 SHA512 SSDEEP TLSH

Gh0st RAT payload

winrar

SHA256 86640c073644d800abd3ac8a4cef4b6a526ba7105480d9a15ee89f7792ff6688
MD5 f355f8b3de9e1a572f48a9ca4be244d5
SHA1 85babb73a4270fed991b3cd49cf5d73fc085f665
SHA512 45ce04c7c609805c987a05fdc3a863d449bfa20df7bcf49361a5d713d7d4896f9614a6b6c4daab8ef92db5b3cfee7305e343ce2d6821f5c960fb6a622617b138
SSDEEP 96:zRlEBmypBKrql3yT4jWq8BWyKUFV7zDacrWUegEGUDSXKGS0G5cgO+f1xwOgOxy0:zAe0yT46qnhUjtaVNt2azF5vNgOMI
TLSH
T155E1B702EECE0FFCE555057C43875FBA112F19B7194D7A6BEF64CA2008A2E71E987186
MD5 SHA1 SHA512 SSDEEP TLSH

Gh0st RAT payload

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_Trojan-GameThief.Win32.Magania.ualj.20a94d41d1bdb84729b4080f5adc2780

kernel32

user32

gdi32

advapi32

shell32

msvcrt

ws2_32

msvcp60

netapi32

wtsapi32

generic

.data

.rdata

.reloc

.rsrc/BITMAP/103.bmp

.rsrc/MANIFEST/1

.rsrc/MENU/102

.rsrc/version.txt

.text

winrar