gh0strat | jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]eebc522753066f234214d6f94ffe50f8

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.eebc522753066f234214d6f94ffe50f8
Size 741KB
Sample261011-1f72lsft9l
SHA256 91380a7a5c716fbfd392cab177472616a2d439fe05321cf5ae5ba1df423985c0
MD5 eebc522753066f234214d6f94ffe50f8
SHA1 a72e2ddf90c02787497eb73b270d53d50e82206d
SHA512 c257b73f1ea50a3e07dfec7da432aa7bafc2906de47f9c5aa4f70a44807e9ca6df8affe073070f596923cfde0a287354d80a36f179be04189fb5b3b2c34b31e3
SSDEEP 3072:uZTvnyEZiGJ7/Qguiry/5s88888888888888888888888888888888888888888O:WBbJ7Giry/c
TLSH
T1F2F4C5FDD2B27384B070C5BC280777E5968D001B8A96D64BC2B0BE1593C9A5DCE6D6F2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat gh0strat

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.eebc522753066f234214d6f94ffe50f8

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.eebc522753066f234214d6f94ffe50f8

.dll 741KB

jaffacakes118_HEUR.Trojan.Win32.Generic.eebc522753066f234214d6f94ffe50f8

IMPHASH e14740af21e8fcc37398cde993fb4f78
SHA256 91380a7a5c716fbfd392cab177472616a2d439fe05321cf5ae5ba1df423985c0
MD5 eebc522753066f234214d6f94ffe50f8
SHA1 a72e2ddf90c02787497eb73b270d53d50e82206d
SHA512 c257b73f1ea50a3e07dfec7da432aa7bafc2906de47f9c5aa4f70a44807e9ca6df8affe073070f596923cfde0a287354d80a36f179be04189fb5b3b2c34b31e3
SSDEEP 3072:uZTvnyEZiGJ7/Qguiry/5s88888888888888888888888888888888888888888O:WBbJ7Giry/c
TLSH
T1F2F4C5FDD2B27384B070C5BC280777E5968D001B8A96D64BC2B0BE1593C9A5DCE6D6F2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Gh0st RAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

47523

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

CreateFileA GlobalMemoryStatus GetSystemInfo GetComputerNameA GetVersionExA OpenEventA SetErrorMode TerminateThread CreateDirectoryA GetCurrentProcess lstrlenA DeleteFileA GetWindowsDirectoryA SetFileAttributesA lstrcmpiA CopyFileA ExpandEnvironmentStringsA GetModuleFileNameA ReadFile CreateProcessA lstrcpyA WriteFile GetSystemDirectoryA ExitProcess Process32Next Process32First CreateToolhelp32Snapshot GetProcessHeap HeapAlloc GetCurrentProcessId CreateThread GetLocalTime GetTickCount CancelIo InterlockedExchange SetEvent ResetEvent GetLastError WaitForSingleObject CloseHandle CreateEventA VirtualAlloc Sleep lstrcatA GetCurrentThreadId FreeLibrary EnterCriticalSection LeaveCriticalSection VirtualFree DeleteCriticalSection LoadLibraryA GetProcAddress SetFilePointer

user32

CloseDesktop SetThreadDesktop OpenInputDesktop GetUserObjectInformationA GetThreadDesktop OpenDesktopA wsprintfA CreateWindowExA LoadMenuA RegisterClassA LoadCursorA LoadIconA GetWindowTextA MessageBoxA

gdi32

GetStockObject

advapi32

RegCloseKey RegisterServiceCtrlHandlerA SetServiceStatus RegCreateKeyExA RegOpenKeyA RegOpenKeyExA RegQueryValueExA ChangeServiceConfig2A LockServiceDatabase CreateServiceA OpenSCManagerA CloseServiceHandle OpenServiceA StartServiceA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken RegSaveKeyA RegRestoreKeyA RegSetValueExA RegDeleteKeyA DeleteService UnlockServiceDatabase

msvcrt

_access _strrev _adjust_fdiv _initterm ??1type_info@@UAE@XZ free calloc malloc strrchr srand _stricmp wcstombs atoi ??3@YAXPAX@Z memmove putchar ceil _ftol puts strstr __CxxFrameHandler ??2@YAPAXI@Z _CxxThrowException rand sprintf strncpy _beginthreadex

ws2_32

WSAIoctl WSACleanup htons gethostbyname socket recv select closesocket send inet_addr connect sendto WSASocketA htonl getsockname WSAStartup setsockopt