Gato Client[.]dll | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Gato Client.dll
Size 8.2MB
Sample261030-vbddjs1s8m
SHA256 858bf44ad6c5710318112eeac25fd9e53a409f5a8c2fb66f723b1281693b341c
MD5 4fe8f25f28bc7ccdf63bf49c0413e1f2
SHA1 18be78161390efaf517ae8a383b3698a4b28d829
SHA512 6480e03dfa0c9489b939daa074a1553642ad3410156de945ab7206df4f753c11472f500818185e2223d680ddb4682b6c87a99e07ce1d21d0567089feb278dc36
SSDEEP 98304:yzPgNdW5CJG6eKe4zzQz4nTRJAo/Y7mgTm05AwJHE6hE:Q4NA5CJGl43QzOJg7PAmk
TLSH
T1F396CF16B3EA01C9D069D478CE53D727E732B8A8533183EB16D14A79DF5B7E04E3AA10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Gato Client.dll

File Explorer

Gato Client.dll

.dll 8.2MB

Gato Client.dll

IMPHASH 22e4e692c47a8d0ab2d3f3d353ec6cf1
SHA256 858bf44ad6c5710318112eeac25fd9e53a409f5a8c2fb66f723b1281693b341c
MD5 4fe8f25f28bc7ccdf63bf49c0413e1f2
SHA1 18be78161390efaf517ae8a383b3698a4b28d829
SHA512 6480e03dfa0c9489b939daa074a1553642ad3410156de945ab7206df4f753c11472f500818185e2223d680ddb4682b6c87a99e07ce1d21d0567089feb278dc36
SSDEEP 98304:yzPgNdW5CJG6eKe4zzQz4nTRJAo/Y7mgTm05AwJHE6hE:Q4NA5CJGl43QzOJg7PAmk
TLSH
T1F396CF16B3EA01C9D069D478CE53D727E732B8A8533183EB16D14A79DF5B7E04E3AA10
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Password

Raid

Minor OS version

Major OS version

Entry point

3513632

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\gaelt\proyectos\GatoClient\x64\Release\Gato Client.pdb

dwrite

DWriteCreateFactory

d2d1

ord2 ord5 ord1

d3d11

D3D11On12CreateDevice D3D11CreateDevice

ole32

CoCreateFreeThreadedMarshaler CoUninitialize CoCreateInstance CoInitializeEx

user32

RegisterClassExW LoadCursorW DispatchMessageW TranslateMessage PeekMessageW DefWindowProcW PostQuitMessage FillRect GetKeyboardLayout ToUnicodeEx ClientToScreen GetWindowTextA SetClipboardData EmptyClipboard GetSystemMetrics ToUnicode GetKeyboardState ScreenToClient GetCursorPos EnumWindows IsWindow GetClientRect GetWindowThreadProcessId GetAsyncKeyState GetDpiForWindow IsWindowVisible SetWindowTextA FindWindowA GetClipboardData CreateWindowExW SetLayeredWindowAttributes ShowWindow GetDC SetCursor OpenClipboard CloseClipboard ReleaseDC DestroyWindow UnregisterClassW MapVirtualKeyW

wininet

InternetCheckConnectionA

kernel32

FreeLibrary LoadLibraryExW FormatMessageW WakeAllConditionVariable InitializeSListHead InterlockedPushEntrySList MoveFileExA LoadLibraryA CreateMutexW SetUnhandledExceptionFilter RtlCaptureStackBackTrace CreateDirectoryA SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetEnvironmentVariableA GetModuleFileNameA GetProcAddress GetModuleHandleA GetComputerNameA SetEvent GlobalUnlock GlobalLock GlobalSize WideCharToMultiByte GetModuleHandleW VirtualQuery Sleep VirtualProtect GetModuleHandleExW FreeLibraryAndExitThread FindFirstFileA FindNextFileA FindClose GetTickCount64 GetCurrentThreadId lstrcpynA CreateFileA WriteFile CloseHandle GetLocalTime SuspendThread GetThreadContext ResumeThread CreateToolhelp32Snapshot Thread32First GetCurrentProcessId OpenThread Thread32Next CreateThread QueryPerformanceCounter QueryPerformanceFrequency FlushInstructionCache GetCurrentProcess MultiByteToWideChar GetFileAttributesW SetThreadPriority GetCurrentThread MoveFileExW DeleteFileW GlobalAlloc GlobalFree GetTickCount CreateFileW HeapReAlloc GetProcessHeap HeapAlloc HeapFree CreateJobObjectW SetInformationJobObject GetTempPathW CreateDirectoryW GetFileAttributesExW CompareFileTime CopyFileW GetLastError GetFullPathNameW GetEnvironmentVariableW SetEnvironmentVariableW CreateProcessW AssignProcessToJobObject WaitForSingleObject TerminateProcess GetExitCodeProcess GetFileSizeEx PeekNamedPipe ReadFile WaitNamedPipeW CreateEventW GetSystemTimeAsFileTime

gdi32

CreateFontW IntersectClipRect DeleteObject SelectObject SetBkMode GetTextExtentPoint32W SetTextColor DeleteDC BitBlt CreateCompatibleBitmap CreateCompatibleDC ExtSelectClipRgn CreatePolygonRgn RestoreDC SaveDC GetTextMetricsW GetTextExtentExPointW GetStockObject Ellipse CreateSolidBrush CreatePen TextOutW

advapi32

RegGetValueA GetUserNameA

shell32

ShellExecuteA

msvcp140

?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z _Thrd_hardware_concurrency _Thrd_join _Thrd_id _Xtime_get_ticks ?_Random_device@std@@YAIXZ ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?tolower@?$ctype@D@std@@QEBADD@Z _Strxfrm ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_K@Z ?_Incref@facet@locale@std@@UEAAXXZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??1facet@locale@std@@MEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ _Strcoll ?id@?$collate@D@std@@2V0locale@2@A ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ __crtLCMapStringA ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??0facet@locale@std@@IEAA@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ?uncaught_exceptions@std@@YAHXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xbad_function_call@std@@YAXXZ _Mtx_unlock ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_lock _Query_perf_counter _Query_perf_frequency ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z _Thrd_detach _Cnd_do_broadcast_at_thread_exit ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Xbad_alloc@std@@YAXXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?id@?$ctype@D@std@@2V0locale@2@A ?_Id_cnt@id@locale@std@@0HA ??Bios_base@std@@QEBA_NXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?good@ios_base@std@@QEBA_NXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

winhttp

WinHttpReceiveResponse WinHttpReadData WinHttpQueryDataAvailable WinHttpCrackUrl WinHttpQueryHeaders WinHttpSetOption WinHttpAddRequestHeaders WinHttpSetTimeouts WinHttpCloseHandle WinHttpOpenRequest WinHttpConnect WinHttpSendRequest WinHttpOpen

mmdevapi

ord17

api-ms-win-core-versionansi-l1-1-1

GetFileVersionInfoA

api-ms-win-core-versionansi-l1-1-0

VerQueryValueA

bcrypt

BCryptCreateHash BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptFinishHash BCryptHashData

api-ms-win-core-heap-l1-1-0

HeapDestroy HeapCreate

api-ms-win-core-processthreads-l1-1-1

SetThreadContext

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo

api-ms-win-core-memory-l1-1-0

VirtualFree VirtualAlloc

api-ms-win-core-synch-l1-2-0

InitOnceComplete InitOnceBeginInitialize SleepConditionVariableSRW

api-ms-win-core-processenvironment-l1-1-0

SetCurrentDirectoryW

api-ms-win-core-file-l1-1-0

SetFileInformationByHandle SetFileTime GetFinalPathNameByHandleW FindFirstFileW FindFirstFileExW GetFileInformationByHandle FindNextFileW

api-ms-win-core-file-l1-2-0

CreateFile2

api-ms-win-core-file-l1-2-2

AreFileApisANSI

api-ms-win-core-file-l2-1-0

CreateHardLinkW GetFileInformationByHandleEx CopyFile2

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-localization-l1-2-0

FormatMessageA GetLocaleInfoEx

api-ms-win-core-synch-l1-1-0

ReleaseSRWLockExclusive AcquireSRWLockExclusive

version

GetFileVersionInfoSizeA

msimg32

GradientFill

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__RTDynamicCast __std_type_info_destroy_list __current_exception_context __current_exception memset memcmp memmove memcpy _CxxThrowException __RTtypeid __std_type_info_compare strchr __std_type_info_name strstr __C_specific_handler __std_exception_destroy __std_exception_copy __std_terminate

api-ms-win-crt-string-l1-1-0

strlen strcmp strnlen isxdigit isalnum towlower toupper iswspace isdigit isalpha wcsnlen strncmp tolower isspace wcslen

api-ms-win-crt-convert-l1-1-0

strtod strtoull strtof atoi strtoll atof strtoul strtol

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _configure_narrow_argv _initialize_narrow_environment _seh_filter_dll _register_onexit_function _execute_onexit_table signal abort _crt_atexit terminate _cexit _initterm _initterm_e _beginthreadex _errno _wassert _invalid_parameter_noinfo_noreturn _invalid_parameter_noinfo

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s feof _get_stream_buffer_pointers fseek __stdio_common_vsprintf fopen_s __stdio_common_vsnprintf_s __stdio_common_vsprintf_s fgetc ungetc fread _fseeki64 fgetpos fsetpos setvbuf fflush fputc fwrite fclose ferror

api-ms-win-crt-locale-l1-1-0

___lc_locale_name_func localeconv ___lc_collate_cp_func ___lc_codepage_func

api-ms-win-crt-heap-l1-1-0

malloc free _callnewh calloc realloc

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-math-l1-1-0

_hypotf ceilf asinf cosf atan2f sin acosf _dsign sqrtf fmaxf fminf lroundf sqrt sinf powf pow log2f roundf log10f atan2 fmodf cbrtf fmod ldexp expf floorf floor

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

oleaut32

SysStringLen SysFreeString GetErrorInfo SetErrorInfo