gh0strat | jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]16b43138e59d3fb4c6adb70b07b8c0e9

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.16b43138e59d3fb4c6adb70b07b8c0e9
Size 118KB
Sample261013-26bxjadf72
SHA256 fa3d01b96ab0385dd30bae98e44b7964c1a28777bca51aedc106a1fbe6a86ec2
MD5 16b43138e59d3fb4c6adb70b07b8c0e9
SHA1 e6faded54d5a05cca30cd6e60449b9a902275ca7
SHA512 ef31a36f926775c8d6396dfb153450ff41cfab3f9eca670cc4d88ce6fc2367a8e4c01df727317f17e1cebf39b24f99d660ff2a52294da997b84db563aaff25c0
SSDEEP 1536:l2qb/FUZtR2CsmRDjD8bcDgmnf1xeXP3/NKE9kEiZ+K:gqyZOCXVjD8bKgmf1xeXI4kEiZ+K
TLSH
T173C36E01F6CE80FAE914147168A9777AEA35EF7873089FB36348CA758817184B65E3C7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat gh0strat

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.16b43138e59d3fb4c6adb70b07b8c0e9

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.16b43138e59d3fb4c6adb70b07b8c0e9

.exe 118KB

jaffacakes118_HEUR.Trojan.Win32.Generic.16b43138e59d3fb4c6adb70b07b8c0e9

IMPHASH 5633765ff034e91952b1983a50c0a4a8
SHA256 fa3d01b96ab0385dd30bae98e44b7964c1a28777bca51aedc106a1fbe6a86ec2
MD5 16b43138e59d3fb4c6adb70b07b8c0e9
SHA1 e6faded54d5a05cca30cd6e60449b9a902275ca7
SHA512 ef31a36f926775c8d6396dfb153450ff41cfab3f9eca670cc4d88ce6fc2367a8e4c01df727317f17e1cebf39b24f99d660ff2a52294da997b84db563aaff25c0
SSDEEP 1536:l2qb/FUZtR2CsmRDjD8bcDgmnf1xeXP3/NKE9kEiZ+K:gqyZOCXVjD8bKgmf1xeXI4kEiZ+K
TLSH
T173C36E01F6CE80FAE914147168A9777AEA35EF7873089FB36348CA758817184B65E3C7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Gh0st RAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

82628

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

msvfw32

ICSendMessage

ole32

CoUninitialize CoCreateInstance CoInitialize

kernel32

CreatePipe GetLastError RaiseException GetStartupInfoA GetModuleHandleA GetProcAddress LoadLibraryA CloseHandle EnterCriticalSection VirtualAlloc lstrlenA CreateEventA WaitForSingleObject ResetEvent lstrcpyA SetEvent InterlockedExchange CancelIo Sleep GetPrivateProfileSectionNamesA lstrcatA GetWindowsDirectoryA FreeLibrary MultiByteToWideChar WideCharToMultiByte lstrcmpA GetPrivateProfileStringA GetVersionExA CreateDirectoryA GetDriveTypeA GetDiskFreeSpaceExA GetVolumeInformationA LocalFree LocalAlloc RemoveDirectoryA CreateFileA WriteFile WritePrivateProfileStringA GetModuleFileNameA CreateThread LeaveCriticalSection DeleteCriticalSection InitializeCriticalSection ExitProcess SetFilePointer GetLocalTime GlobalFree GlobalUnlock GlobalSize CreateMutexA

msvcrt

free _except_handler3 strrchr rename atoi strncmp strncpy _errno _snprintf _beginthreadex calloc _exit malloc exit _acmdln __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _controlfp strchr strstr _ftol ceil memmove __CxxFrameHandler ??3@YAXPAX@Z ??2@YAPAXI@Z _strnicmp _XcptFilter _strupr

msvcp60

?_Xran@std@@YAXXZ ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB