4e8080d7574aa4563ccbe3d3594bfd8ae32fd9aebd3da38a17dfc5ba3d48f229
- SHA256 4e8080d7574aa4563ccbe3d3594bfd8ae32fd9aebd3da38a17dfc5ba3d48f229
Overview
overview
10Static
static
101332390.dll
windows10-2004-x64
101332390.dll
windows11-ltsc_2024-x64
10175439750.dll
windows10-2004-x64
10175439750.dll
windows11-ltsc_2024-x64
10175453312.dll
windows10-2004-x64
10175453312.dll
windows11-ltsc_2024-x64
10350743656.dll
windows10-2004-x64
10350743656.dll
windows11-ltsc_2024-x64
10397073000.dll
windows10-2004-x64
10397073000.dll
windows11-ltsc_2024-x64
10637690500.dll
windows10-2004-x64
10637690500.dll
windows11-ltsc_2024-x64
1084309031.dll
windows10-2004-x64
1084309031.dll
windows11-ltsc_2024-x64
1084463156.dll
windows10-2004-x64
1084463156.dll
windows11-ltsc_2024-x64
1084518578.dll
windows10-2004-x64
1084518578.dll
windows11-ltsc_2024-x64
10854816890.dll
windows10-2004-x64
10854816890.dll
windows11-ltsc_2024-x64
1093388484.dll
windows10-2004-x64
1093388484.dll
windows11-ltsc_2024-x64
1093417718.dll
windows10-2004-x64
1093417718.dll
windows11-ltsc_2024-x64
1093999343.dll
windows10-2004-x64
1093999343.dll
windows11-ltsc_2024-x64
10TXPlatforn.exe
windows10-2004-x64
10TXPlatforn.exe
windows11-ltsc_2024-x64
10Behavioral task
behavioral1
Sample
1332390.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
1332390.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral3
Sample
175439750.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
175439750.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral5
Sample
175453312.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral6
Sample
175453312.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral7
Sample
350743656.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral8
Sample
350743656.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral9
Sample
397073000.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral10
Sample
397073000.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral11
Sample
637690500.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral12
Sample
637690500.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral13
Sample
84309031.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral14
Sample
84309031.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral15
Sample
84463156.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral16
Sample
84463156.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral17
Sample
84518578.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral18
Sample
84518578.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral19
Sample
854816890.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral20
Sample
854816890.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral21
Sample
93388484.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral22
Sample
93388484.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral23
Sample
93417718.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral24
Sample
93417718.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral25
Sample
93999343.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral26
Sample
93999343.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral27
Sample
TXPlatforn.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
17 signatures
150 seconds
General
- Target 4e8080d7574aa4563ccbe3d3594bfd8ae32fd9aebd3da38a17dfc5ba3d48f229
- Size 694KB
- Sample261102-le61lastcx
- SHA256 4e8080d7574aa4563ccbe3d3594bfd8ae32fd9aebd3da38a17dfc5ba3d48f229
- MD5 076e410a4560defc8a07ff9965ba2cf4
- SHA1 b1efdebf77f52f7173a64ef84bbbfa3574de48da
- SHA512 e7c8d2e5e4f1e68d7c32cf28be2cfcdde97426b02c7cb2db17cef46a93232925928ec29742543e9bdf5f69dd6270972de9556921719e1d701fca697633bb3fe8
- SSDEEP 12288:D4ye4yo4yA4yE4yN4y4U4yc4yZ4DF43o43k4yvWi/QHSAdOzUqghAA3YngM/1tMx:8yJy7yzyPyGF/ynyKDe373vyei/UdCUp
- TLSH T188E4022085198371C993133897BCA6B3D8ACA3451EEE3B606DB5953D1BE04B2BC5397F
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Gh0st RAT payload 13 IoCs
resource yara_rule static1/unpack001/1332390.bat family_gh0strat static1/unpack001/175439750.bat family_gh0strat static1/unpack001/175453312.bat family_gh0strat static1/unpack001/350743656.bat family_gh0strat static1/unpack001/397073000.bat family_gh0strat static1/unpack001/637690500.bat family_gh0strat static1/unpack001/84309031.bat family_gh0strat static1/unpack001/84463156.bat family_gh0strat static1/unpack001/84518578.bat family_gh0strat static1/unpack001/854816890.bat family_gh0strat static1/unpack001/93388484.bat family_gh0strat static1/unpack001/93417718.bat family_gh0strat static1/unpack001/93999343.bat family_gh0strat - Unsigned PE 14 IoCs
Checks for missing Authenticode signature.
resource unpack001/1332390.bat unpack001/175439750.bat unpack001/175453312.bat unpack001/350743656.bat unpack001/397073000.bat unpack001/637690500.bat unpack001/84309031.bat unpack001/84463156.bat unpack001/84518578.bat unpack001/854816890.bat unpack001/93388484.bat unpack001/93417718.bat unpack001/93999343.bat unpack001/TXPlatforn.exe
File Explorer
-
4e8080d7574aa4563ccbe3d3594bfd8ae32fd9aebd3da38a17dfc5ba3d48f229.zip 694KB
-
1332390.bat.dll 51KB
-
175439750.bat.dll 51KB
-
175453312.bat.dll 51KB
-
350743656.bat.dll 51KB
-
397073000.bat.dll 51KB
-
637690500.bat.dll 51KB
-
84309031.bat.dll 51KB
-
84463156.bat.dll 51KB
-
84518578.bat.dll 51KB
-
854816890.bat.dll 51KB
-
93388484.bat.dll 51KB
-
93417718.bat.dll 51KB
-
93999343.bat.dll 51KB
-
TXPlatforn.exe.exe 377KB
1332390.bat
- IMPHASH 4847c8aea5b26a115e9f4b1fffee02d5
- SHA256 6d5eeac3bcd1180aa057fa1b20a4c4c604a6167871c48b4b9ea2e2d57ea64bc8
- MD5 0842f7cbeb13b5e4302b4045f5e52266
- SHA1 914a6584a347001d6187cf9723cc040742610592
- SHA512 c07641486d174e971c5c373ca5b7bb169cf8225beaa9311dbe1121ffaa55970c9e75a3a5e8be9fd8b94c9f08eafdbb9e32ac1b2bb32f49175a6b20589e6f3bab
- SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLXJYH5:1dWubF3n9S91BF3fboTJYH5
- TLSH T1D1333A02EE8D88F5F145177038AA33B6953ABDE036996A931F53DDA5C87B370F12D242
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Gh0st RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
38440
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrlenA
lstrcpyA
FreeLibrary
GetProcAddress
LoadLibraryA
GetTickCount
WinExec
ReadFile
GetFileAttributesA
LocalFree
LocalSize
LocalAlloc
lstrcatA
GetCurrentProcessId
Process32Next
TerminateProcess
OpenProcess
Process32First
CopyFileA
GetModuleFileNameA
GetLastError
WaitForSingleObject
CreateProcessA
GetCurrentDirectoryA
FreeConsole
GetModuleHandleA
HeapAlloc
GetProcessHeap
VirtualProtect
HeapFree
InitializeCriticalSection
DeleteCriticalSection
CreateThread
LeaveCriticalSection
EnterCriticalSection
SetEvent
CreateEventA
WritePrivateProfileStringA
GetSystemDirectoryA
GetPrivateProfileStringA
lstrcmpiA
GetFileSize
CreateFileA
SetFilePointer
WriteFile
CloseHandle
Sleep
InterlockedExchange
VirtualAlloc
GlobalMemoryStatusEx
VirtualFree
user32
GetWindowThreadProcessId
GetLastInputInfo
wsprintfA
ChangeDisplaySettingsA
GetSystemMetrics
advapi32
RegQueryValueA
RegSetValueExA
RegCloseKey
CloseServiceHandle
ControlService
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegOpenKeyExA
shell32
SHGetSpecialFolderPathA
ole32
CoCreateInstance
CoInitialize
oleaut32
VariantClear
VariantInit
mfc42
ord825
ord823
msvcrt
_strupr
_strcmpi
_stricmp
_strnicmp
_onexit
??1type_info@@UAE@XZ
_beginthreadex
_errno
realloc
strchr
_adjust_fdiv
__dllonexit
_initterm
ceil
_ftol
__CxxFrameHandler
_CxxThrowException
_except_handler3
_local_unwind2
rand
strstr
strncpy
strrchr
free
malloc
printf
atoi
strcspn
wcstombs
urlmon
URLDownloadToFileA
ws2_32
connect
inet_addr
getsockname
WSAStartup
WSACleanup
closesocket
ntohs
listen
bind
socket
accept
htons
gethostbyname
sendto
recvfrom
__WSAFDIsSet
select
send
recv
getpeername
inet_ntoa
iphlpapi
GetIfTable
GetAdaptersInfo
DllUpdate
Install
MainThread
ServiceMain
Uninstall
Name
.text
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=12, version=7291,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=11, version=8047,
count=3, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=2, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=4, version=9782,
count=1, productName=Unmarked objects (old),
count=125, id=1, productName=Unmarked objects,
count=19, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=13, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
175439750.bat
- IMPHASH 4847c8aea5b26a115e9f4b1fffee02d5
- SHA256 4bc86aebc92cab26fb6b05f4647dd99098a5316dfcb6e963e4fb91a742284a81
- MD5 dca5fb2c6effbe6d6cfbdec08aa3e7eb
- SHA1 719cad7bb62a04c3090bc15141c525da597ef8cd
- SHA512 ad448b74ef476972a764cace97bbd62933a0c2472d4f5d95f91cc08a4d8cede1b23a410ed2f41aa39401805be8ff0fe59a9f969f4fb6256783de390f8dca2f57
- SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL/JYH5:1dWubF3n9S91BF3fborJYH5
- TLSH T1E1333A02EE8D88F5F145177038AA33B6953ABDE036996A931F53DDA5C87B370F12D242
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Gh0st RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
38440
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrlenA
lstrcpyA
FreeLibrary
GetProcAddress
LoadLibraryA
GetTickCount
WinExec
ReadFile
GetFileAttributesA
LocalFree
LocalSize
LocalAlloc
lstrcatA
GetCurrentProcessId
Process32Next
TerminateProcess
OpenProcess
Process32First
CopyFileA
GetModuleFileNameA
GetLastError
WaitForSingleObject
CreateProcessA
GetCurrentDirectoryA
FreeConsole
GetModuleHandleA
HeapAlloc
GetProcessHeap
VirtualProtect
HeapFree
InitializeCriticalSection
DeleteCriticalSection
CreateThread
LeaveCriticalSection
EnterCriticalSection
SetEvent
CreateEventA
WritePrivateProfileStringA
GetSystemDirectoryA
GetPrivateProfileStringA
lstrcmpiA
GetFileSize
CreateFileA
SetFilePointer
WriteFile
CloseHandle
Sleep
InterlockedExchange
VirtualAlloc
GlobalMemoryStatusEx
VirtualFree
user32
GetWindowThreadProcessId
GetLastInputInfo
wsprintfA
ChangeDisplaySettingsA
GetSystemMetrics
advapi32
RegQueryValueA
RegSetValueExA
RegCloseKey
CloseServiceHandle
ControlService
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegOpenKeyExA
shell32
SHGetSpecialFolderPathA
ole32
CoCreateInstance
CoInitialize
oleaut32
VariantClear
VariantInit
mfc42
ord825
ord823
msvcrt
_strupr
_strcmpi
_stricmp
_strnicmp
_onexit
??1type_info@@UAE@XZ
_beginthreadex
_errno
realloc
strchr
_adjust_fdiv
__dllonexit
_initterm
ceil
_ftol
__CxxFrameHandler
_CxxThrowException
_except_handler3
_local_unwind2
rand
strstr
strncpy
strrchr
free
malloc
printf
atoi
strcspn
wcstombs
urlmon
URLDownloadToFileA
ws2_32
connect
inet_addr
getsockname
WSAStartup
WSACleanup
closesocket
ntohs
listen
bind
socket
accept
htons
gethostbyname
sendto
recvfrom
__WSAFDIsSet
select
send
recv
getpeername
inet_ntoa
iphlpapi
GetIfTable
GetAdaptersInfo
DllUpdate
Install
MainThread
ServiceMain
Uninstall
Name
.text
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=12, version=7291,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=11, version=8047,
count=3, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=2, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=4, version=9782,
count=1, productName=Unmarked objects (old),
count=125, id=1, productName=Unmarked objects,
count=19, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=13, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
175453312.bat
- IMPHASH 4847c8aea5b26a115e9f4b1fffee02d5
- SHA256 4bc86aebc92cab26fb6b05f4647dd99098a5316dfcb6e963e4fb91a742284a81
- MD5 dca5fb2c6effbe6d6cfbdec08aa3e7eb
- SHA1 719cad7bb62a04c3090bc15141c525da597ef8cd
- SHA512 ad448b74ef476972a764cace97bbd62933a0c2472d4f5d95f91cc08a4d8cede1b23a410ed2f41aa39401805be8ff0fe59a9f969f4fb6256783de390f8dca2f57
- SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL/JYH5:1dWubF3n9S91BF3fborJYH5
- TLSH T1E1333A02EE8D88F5F145177038AA33B6953ABDE036996A931F53DDA5C87B370F12D242
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Gh0st RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
38440
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrlenA
lstrcpyA
FreeLibrary
GetProcAddress
LoadLibraryA
GetTickCount
WinExec
ReadFile
GetFileAttributesA
LocalFree
LocalSize
LocalAlloc
lstrcatA
GetCurrentProcessId
Process32Next
TerminateProcess
OpenProcess
Process32First
CopyFileA
GetModuleFileNameA
GetLastError
WaitForSingleObject
CreateProcessA
GetCurrentDirectoryA
FreeConsole
GetModuleHandleA
HeapAlloc
GetProcessHeap
VirtualProtect
HeapFree
InitializeCriticalSection
DeleteCriticalSection
CreateThread
LeaveCriticalSection
EnterCriticalSection
SetEvent
CreateEventA
WritePrivateProfileStringA
GetSystemDirectoryA
GetPrivateProfileStringA
lstrcmpiA
GetFileSize
CreateFileA
SetFilePointer
WriteFile
CloseHandle
Sleep
InterlockedExchange
VirtualAlloc
GlobalMemoryStatusEx
VirtualFree
user32
GetWindowThreadProcessId
GetLastInputInfo
wsprintfA
ChangeDisplaySettingsA
GetSystemMetrics
advapi32
RegQueryValueA
RegSetValueExA
RegCloseKey
CloseServiceHandle
ControlService
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegOpenKeyExA
shell32
SHGetSpecialFolderPathA
ole32
CoCreateInstance
CoInitialize
oleaut32
VariantClear
VariantInit
mfc42
ord825
ord823
msvcrt
_strupr
_strcmpi
_stricmp
_strnicmp
_onexit
??1type_info@@UAE@XZ
_beginthreadex
_errno
realloc
strchr
_adjust_fdiv
__dllonexit
_initterm
ceil
_ftol
__CxxFrameHandler
_CxxThrowException
_except_handler3
_local_unwind2
rand
strstr
strncpy
strrchr
free
malloc
printf
atoi
strcspn
wcstombs
urlmon
URLDownloadToFileA
ws2_32
connect
inet_addr
getsockname
WSAStartup
WSACleanup
closesocket
ntohs
listen
bind
socket
accept
htons
gethostbyname
sendto
recvfrom
__WSAFDIsSet
select
send
recv
getpeername
inet_ntoa
iphlpapi
GetIfTable
GetAdaptersInfo
DllUpdate
Install
MainThread
ServiceMain
Uninstall
Name
.text
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=12, version=7291,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=11, version=8047,
count=3, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=2, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=4, version=9782,
count=1, productName=Unmarked objects (old),
count=125, id=1, productName=Unmarked objects,
count=19, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=13, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
350743656.bat
- IMPHASH 4847c8aea5b26a115e9f4b1fffee02d5
- SHA256 ceb21952afa73c05349eaea6b4e2796009e2e365488cd867fcd626f942cf6862
- MD5 63e146b6a367ccd21bb98304607d3286
- SHA1 80790206cee9e5bc7349d76e43c52b807add9f7a
- SHA512 6ab6c2a5358e4660ed24f3b34b5ed895eb22283dcbc57f94509f5cd869e3050ffe1e080a58fb37fbba50bb40341c6cfae802c42aa3bf424d770481fd66170b17
- SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLfJYH5:1dWubF3n9S91BF3fbozJYH5
- TLSH T1BE333A02EE8D88F5F145177038AA33B6953ABDE036996A931F53DDA5C87B370F12D242
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Gh0st RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
38440
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrlenA
lstrcpyA
FreeLibrary
GetProcAddress
LoadLibraryA
GetTickCount
WinExec
ReadFile
GetFileAttributesA
LocalFree
LocalSize
LocalAlloc
lstrcatA
GetCurrentProcessId
Process32Next
TerminateProcess
OpenProcess
Process32First
CopyFileA
GetModuleFileNameA
GetLastError
WaitForSingleObject
CreateProcessA
GetCurrentDirectoryA
FreeConsole
GetModuleHandleA
HeapAlloc
GetProcessHeap
VirtualProtect
HeapFree
InitializeCriticalSection
DeleteCriticalSection
CreateThread
LeaveCriticalSection
EnterCriticalSection
SetEvent
CreateEventA
WritePrivateProfileStringA
GetSystemDirectoryA
GetPrivateProfileStringA
lstrcmpiA
GetFileSize
CreateFileA
SetFilePointer
WriteFile
CloseHandle
Sleep
InterlockedExchange
VirtualAlloc
GlobalMemoryStatusEx
VirtualFree
user32
GetWindowThreadProcessId
GetLastInputInfo
wsprintfA
ChangeDisplaySettingsA
GetSystemMetrics
advapi32
RegQueryValueA
RegSetValueExA
RegCloseKey
CloseServiceHandle
ControlService
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegOpenKeyExA
shell32
SHGetSpecialFolderPathA
ole32
CoCreateInstance
CoInitialize
oleaut32
VariantClear
VariantInit
mfc42
ord825
ord823
msvcrt
_strupr
_strcmpi
_stricmp
_strnicmp
_onexit
??1type_info@@UAE@XZ
_beginthreadex
_errno
realloc
strchr
_adjust_fdiv
__dllonexit
_initterm
ceil
_ftol
__CxxFrameHandler
_CxxThrowException
_except_handler3
_local_unwind2
rand
strstr
strncpy
strrchr
free
malloc
printf
atoi
strcspn
wcstombs
urlmon
URLDownloadToFileA
ws2_32
connect
inet_addr
getsockname
WSAStartup
WSACleanup
closesocket
ntohs
listen
bind
socket
accept
htons
gethostbyname
sendto
recvfrom
__WSAFDIsSet
select
send
recv
getpeername
inet_ntoa
iphlpapi
GetIfTable
GetAdaptersInfo
DllUpdate
Install
MainThread
ServiceMain
Uninstall
Name
.text
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=12, version=7291,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=11, version=8047,
count=3, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=2, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=4, version=9782,
count=1, productName=Unmarked objects (old),
count=125, id=1, productName=Unmarked objects,
count=19, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=13, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
397073000.bat
- IMPHASH 4847c8aea5b26a115e9f4b1fffee02d5
- SHA256 530e31c1fc8341f9fc47a8e733b80962664b017e3a800e81037b1f635033917d
- MD5 ce37f17177b8afb2c2f5bb83851a9c36
- SHA1 8dfd87eaa08e45606537dbcbfad3b9d6cb2f6223
- SHA512 e6f8e18ca4929d10aeb2e387a959f61fd03749adf0b90c0f362211bca50b970a5d6789043d9c1618088585e8aa230d5a39c38ed6b685143f7889ff2f444d4227
- SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLvJYH5:1dWubF3n9S91BF3fborJYH5
- TLSH T1E3333A02EE8D88F5F145177038AA33B6953ABDE036996A931F53DDA5C87B370F12D242
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Gh0st RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
38440
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrlenA
lstrcpyA
FreeLibrary
GetProcAddress
LoadLibraryA
GetTickCount
WinExec
ReadFile
GetFileAttributesA
LocalFree
LocalSize
LocalAlloc
lstrcatA
GetCurrentProcessId
Process32Next
TerminateProcess
OpenProcess
Process32First
CopyFileA
GetModuleFileNameA
GetLastError
WaitForSingleObject
CreateProcessA
GetCurrentDirectoryA
FreeConsole
GetModuleHandleA
HeapAlloc
GetProcessHeap
VirtualProtect
HeapFree
InitializeCriticalSection
DeleteCriticalSection
CreateThread
LeaveCriticalSection
EnterCriticalSection
SetEvent
CreateEventA
WritePrivateProfileStringA
GetSystemDirectoryA
GetPrivateProfileStringA
lstrcmpiA
GetFileSize
CreateFileA
SetFilePointer
WriteFile
CloseHandle
Sleep
InterlockedExchange
VirtualAlloc
GlobalMemoryStatusEx
VirtualFree
user32
GetWindowThreadProcessId
GetLastInputInfo
wsprintfA
ChangeDisplaySettingsA
GetSystemMetrics
advapi32
RegQueryValueA
RegSetValueExA
RegCloseKey
CloseServiceHandle
ControlService
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegOpenKeyExA
shell32
SHGetSpecialFolderPathA
ole32
CoCreateInstance
CoInitialize
oleaut32
VariantClear
VariantInit
mfc42
ord825
ord823
msvcrt
_strupr
_strcmpi
_stricmp
_strnicmp
_onexit
??1type_info@@UAE@XZ
_beginthreadex
_errno
realloc
strchr
_adjust_fdiv
__dllonexit
_initterm
ceil
_ftol
__CxxFrameHandler
_CxxThrowException
_except_handler3
_local_unwind2
rand
strstr
strncpy
strrchr
free
malloc
printf
atoi
strcspn
wcstombs
urlmon
URLDownloadToFileA
ws2_32
connect
inet_addr
getsockname
WSAStartup
WSACleanup
closesocket
ntohs
listen
bind
socket
accept
htons
gethostbyname
sendto
recvfrom
__WSAFDIsSet
select
send
recv
getpeername
inet_ntoa
iphlpapi
GetIfTable
GetAdaptersInfo
DllUpdate
Install
MainThread
ServiceMain
Uninstall
Name
.text
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=12, version=7291,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=11, version=8047,
count=3, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=2, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=4, version=9782,
count=1, productName=Unmarked objects (old),
count=125, id=1, productName=Unmarked objects,
count=19, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=13, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
637690500.bat
- IMPHASH 4847c8aea5b26a115e9f4b1fffee02d5
- SHA256 f8d496dec2053d66e02a6940c0c3db1727451104f41e783fe0c8d80c7a007164
- MD5 5845224f3368cc6e52bd054cf40cf127
- SHA1 a72a70f24f071dcca29f15e11c465fd03a9f64a3
- SHA512 8858057e25ce27f0a02c78e1f02e518b2228b4b0145da0f046d336c926217693e3cce373b2484b5e04069d978fad942705b97a6b439356be808d21678331bcbe
- SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLjJYH5:1dWubF3n9S91BF3fboHJYH5
- TLSH T1AD333A02EE8D88F5F145177038AA33B6953ABDE036996A931F53DDA5C87B370F12D242
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Gh0st RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
38440
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrlenA
lstrcpyA
FreeLibrary
GetProcAddress
LoadLibraryA
GetTickCount
WinExec
ReadFile
GetFileAttributesA
LocalFree
LocalSize
LocalAlloc
lstrcatA
GetCurrentProcessId
Process32Next
TerminateProcess
OpenProcess
Process32First
CopyFileA
GetModuleFileNameA
GetLastError
WaitForSingleObject
CreateProcessA
GetCurrentDirectoryA
FreeConsole
GetModuleHandleA
HeapAlloc
GetProcessHeap
VirtualProtect
HeapFree
InitializeCriticalSection
DeleteCriticalSection
CreateThread
LeaveCriticalSection
EnterCriticalSection
SetEvent
CreateEventA
WritePrivateProfileStringA
GetSystemDirectoryA
GetPrivateProfileStringA
lstrcmpiA
GetFileSize
CreateFileA
SetFilePointer
WriteFile
CloseHandle
Sleep
InterlockedExchange
VirtualAlloc
GlobalMemoryStatusEx
VirtualFree
user32
GetWindowThreadProcessId
GetLastInputInfo
wsprintfA
ChangeDisplaySettingsA
GetSystemMetrics
advapi32
RegQueryValueA
RegSetValueExA
RegCloseKey
CloseServiceHandle
ControlService
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegOpenKeyExA
shell32
SHGetSpecialFolderPathA
ole32
CoCreateInstance
CoInitialize
oleaut32
VariantClear
VariantInit
mfc42
ord825
ord823
msvcrt
_strupr
_strcmpi
_stricmp
_strnicmp
_onexit
??1type_info@@UAE@XZ
_beginthreadex
_errno
realloc
strchr
_adjust_fdiv
__dllonexit
_initterm
ceil
_ftol
__CxxFrameHandler
_CxxThrowException
_except_handler3
_local_unwind2
rand
strstr
strncpy
strrchr
free
malloc
printf
atoi
strcspn
wcstombs
urlmon
URLDownloadToFileA
ws2_32
connect
inet_addr
getsockname
WSAStartup
WSACleanup
closesocket
ntohs
listen
bind
socket
accept
htons
gethostbyname
sendto
recvfrom
__WSAFDIsSet
select
send
recv
getpeername
inet_ntoa
iphlpapi
GetIfTable
GetAdaptersInfo
DllUpdate
Install
MainThread
ServiceMain
Uninstall
Name
.text
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=12, version=7291,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=11, version=8047,
count=3, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=2, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=4, version=9782,
count=1, productName=Unmarked objects (old),
count=125, id=1, productName=Unmarked objects,
count=19, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=13, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
84309031.bat
- IMPHASH 4847c8aea5b26a115e9f4b1fffee02d5
- SHA256 24ce1b7dd645a2051b87335300d44c56f5884e81cb8949879995c394b0c8e836
- MD5 363bc77e76b13d5045bc223d60cc2bbf
- SHA1 0b6558e943180a730da37c238df9c103cc83f611
- SHA512 cf1630db6dce2fa85dffc3225fbd53fa2751738c5374404afcb432304cadfd367ec674d6048fa1a32f8bb9e495d68022dd8de23b3a9b6c1c9f9505ec19b41d14
- SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLVJYH5:1dWubF3n9S91BF3fboZJYH5
- TLSH T192334A02EE8D88F5F145177038AA33B6953ABDE036996A931F53DDA5C87B370F12D242
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Gh0st RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
38440
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrlenA
lstrcpyA
FreeLibrary
GetProcAddress
LoadLibraryA
GetTickCount
WinExec
ReadFile
GetFileAttributesA
LocalFree
LocalSize
LocalAlloc
lstrcatA
GetCurrentProcessId
Process32Next
TerminateProcess
OpenProcess
Process32First
CopyFileA
GetModuleFileNameA
GetLastError
WaitForSingleObject
CreateProcessA
GetCurrentDirectoryA
FreeConsole
GetModuleHandleA
HeapAlloc
GetProcessHeap
VirtualProtect
HeapFree
InitializeCriticalSection
DeleteCriticalSection
CreateThread
LeaveCriticalSection
EnterCriticalSection
SetEvent
CreateEventA
WritePrivateProfileStringA
GetSystemDirectoryA
GetPrivateProfileStringA
lstrcmpiA
GetFileSize
CreateFileA
SetFilePointer
WriteFile
CloseHandle
Sleep
InterlockedExchange
VirtualAlloc
GlobalMemoryStatusEx
VirtualFree
user32
GetWindowThreadProcessId
GetLastInputInfo
wsprintfA
ChangeDisplaySettingsA
GetSystemMetrics
advapi32
RegQueryValueA
RegSetValueExA
RegCloseKey
CloseServiceHandle
ControlService
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegOpenKeyExA
shell32
SHGetSpecialFolderPathA
ole32
CoCreateInstance
CoInitialize
oleaut32
VariantClear
VariantInit
mfc42
ord825
ord823
msvcrt
_strupr
_strcmpi
_stricmp
_strnicmp
_onexit
??1type_info@@UAE@XZ
_beginthreadex
_errno
realloc
strchr
_adjust_fdiv
__dllonexit
_initterm
ceil
_ftol
__CxxFrameHandler
_CxxThrowException
_except_handler3
_local_unwind2
rand
strstr
strncpy
strrchr
free
malloc
printf
atoi
strcspn
wcstombs
urlmon
URLDownloadToFileA
ws2_32
connect
inet_addr
getsockname
WSAStartup
WSACleanup
closesocket
ntohs
listen
bind
socket
accept
htons
gethostbyname
sendto
recvfrom
__WSAFDIsSet
select
send
recv
getpeername
inet_ntoa
iphlpapi
GetIfTable
GetAdaptersInfo
DllUpdate
Install
MainThread
ServiceMain
Uninstall
Name
.text
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=12, version=7291,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=11, version=8047,
count=3, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=2, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=4, version=9782,
count=1, productName=Unmarked objects (old),
count=125, id=1, productName=Unmarked objects,
count=19, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=13, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
84463156.bat
- IMPHASH 4847c8aea5b26a115e9f4b1fffee02d5
- SHA256 ea1a2877f4b6389b127803f62f3c91c4bb617f06d8f83e9e50d28a8c76fd892c
- MD5 ab9b8ed7bd5b2e08c3e43bae60d15a9e
- SHA1 710e047e98e58dcc899d44a2cce05e1a285d124d
- SHA512 396a420a49920c9e01b56b15a0a83ee9516f8e421f18e74a777e962c1f7f912714aee860fdd1563a88da591a31d9a63042cae88e883e4a37da632da00473812d
- SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLtJYH5:1dWubF3n9S91BF3fboxJYH5
- TLSH T1C5334A02EE8D88F5F145177038AA33B6953ABDE036996A931F53DDA5C87B370F12D242
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Gh0st RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
38440
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrlenA
lstrcpyA
FreeLibrary
GetProcAddress
LoadLibraryA
GetTickCount
WinExec
ReadFile
GetFileAttributesA
LocalFree
LocalSize
LocalAlloc
lstrcatA
GetCurrentProcessId
Process32Next
TerminateProcess
OpenProcess
Process32First
CopyFileA
GetModuleFileNameA
GetLastError
WaitForSingleObject
CreateProcessA
GetCurrentDirectoryA
FreeConsole
GetModuleHandleA
HeapAlloc
GetProcessHeap
VirtualProtect
HeapFree
InitializeCriticalSection
DeleteCriticalSection
CreateThread
LeaveCriticalSection
EnterCriticalSection
SetEvent
CreateEventA
WritePrivateProfileStringA
GetSystemDirectoryA
GetPrivateProfileStringA
lstrcmpiA
GetFileSize
CreateFileA
SetFilePointer
WriteFile
CloseHandle
Sleep
InterlockedExchange
VirtualAlloc
GlobalMemoryStatusEx
VirtualFree
user32
GetWindowThreadProcessId
GetLastInputInfo
wsprintfA
ChangeDisplaySettingsA
GetSystemMetrics
advapi32
RegQueryValueA
RegSetValueExA
RegCloseKey
CloseServiceHandle
ControlService
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegOpenKeyExA
shell32
SHGetSpecialFolderPathA
ole32
CoCreateInstance
CoInitialize
oleaut32
VariantClear
VariantInit
mfc42
ord825
ord823
msvcrt
_strupr
_strcmpi
_stricmp
_strnicmp
_onexit
??1type_info@@UAE@XZ
_beginthreadex
_errno
realloc
strchr
_adjust_fdiv
__dllonexit
_initterm
ceil
_ftol
__CxxFrameHandler
_CxxThrowException
_except_handler3
_local_unwind2
rand
strstr
strncpy
strrchr
free
malloc
printf
atoi
strcspn
wcstombs
urlmon
URLDownloadToFileA
ws2_32
connect
inet_addr
getsockname
WSAStartup
WSACleanup
closesocket
ntohs
listen
bind
socket
accept
htons
gethostbyname
sendto
recvfrom
__WSAFDIsSet
select
send
recv
getpeername
inet_ntoa
iphlpapi
GetIfTable
GetAdaptersInfo
DllUpdate
Install
MainThread
ServiceMain
Uninstall
Name
.text
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=12, version=7291,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=11, version=8047,
count=3, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=2, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=4, version=9782,
count=1, productName=Unmarked objects (old),
count=125, id=1, productName=Unmarked objects,
count=19, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=13, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
84518578.bat
- IMPHASH 4847c8aea5b26a115e9f4b1fffee02d5
- SHA256 3f900e52e5fc6e9411345c008455dc3438f36fe20c4de6616221e7efd7af3c20
- MD5 69379a1d0dfd8b5a9c7a0272d8e9e24c
- SHA1 935f9171d6a5920bcab14aa8a757544ff27a88e9
- SHA512 bcb167769a959f05bf0abe130f787d9ef765f27ddb7631f69b2fbc5d802a51086ea6f278368e2d42c2ff70b2226b8e8f9b6978b132acb63e4f383c4c87191873
- SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLsJYH5:1dWubF3n9S91BF3fboAJYH5
- TLSH T11A334A02EE8D88F5F145177038AA33B6953ABDE036996A931F53DDA5C87B370F12D242
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Gh0st RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
38440
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrlenA
lstrcpyA
FreeLibrary
GetProcAddress
LoadLibraryA
GetTickCount
WinExec
ReadFile
GetFileAttributesA
LocalFree
LocalSize
LocalAlloc
lstrcatA
GetCurrentProcessId
Process32Next
TerminateProcess
OpenProcess
Process32First
CopyFileA
GetModuleFileNameA
GetLastError
WaitForSingleObject
CreateProcessA
GetCurrentDirectoryA
FreeConsole
GetModuleHandleA
HeapAlloc
GetProcessHeap
VirtualProtect
HeapFree
InitializeCriticalSection
DeleteCriticalSection
CreateThread
LeaveCriticalSection
EnterCriticalSection
SetEvent
CreateEventA
WritePrivateProfileStringA
GetSystemDirectoryA
GetPrivateProfileStringA
lstrcmpiA
GetFileSize
CreateFileA
SetFilePointer
WriteFile
CloseHandle
Sleep
InterlockedExchange
VirtualAlloc
GlobalMemoryStatusEx
VirtualFree
user32
GetWindowThreadProcessId
GetLastInputInfo
wsprintfA
ChangeDisplaySettingsA
GetSystemMetrics
advapi32
RegQueryValueA
RegSetValueExA
RegCloseKey
CloseServiceHandle
ControlService
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegOpenKeyExA
shell32
SHGetSpecialFolderPathA
ole32
CoCreateInstance
CoInitialize
oleaut32
VariantClear
VariantInit
mfc42
ord825
ord823
msvcrt
_strupr
_strcmpi
_stricmp
_strnicmp
_onexit
??1type_info@@UAE@XZ
_beginthreadex
_errno
realloc
strchr
_adjust_fdiv
__dllonexit
_initterm
ceil
_ftol
__CxxFrameHandler
_CxxThrowException
_except_handler3
_local_unwind2
rand
strstr
strncpy
strrchr
free
malloc
printf
atoi
strcspn
wcstombs
urlmon
URLDownloadToFileA
ws2_32
connect
inet_addr
getsockname
WSAStartup
WSACleanup
closesocket
ntohs
listen
bind
socket
accept
htons
gethostbyname
sendto
recvfrom
__WSAFDIsSet
select
send
recv
getpeername
inet_ntoa
iphlpapi
GetIfTable
GetAdaptersInfo
DllUpdate
Install
MainThread
ServiceMain
Uninstall
Name
.text
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=12, version=7291,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=11, version=8047,
count=3, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=2, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=4, version=9782,
count=1, productName=Unmarked objects (old),
count=125, id=1, productName=Unmarked objects,
count=19, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=13, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
854816890.bat
- IMPHASH 4847c8aea5b26a115e9f4b1fffee02d5
- SHA256 ef460ebad49c6ae147855b31453403de41d14927972428964a457c2ff9a6821e
- MD5 baea98a5f6ff67ac27d9327adb60bbc0
- SHA1 229dd5f69990a242225f47b8368f408fa6d066a6
- SHA512 aa1cd387ed4727e60eecd11a5a467442f44ed5aa0743990d5968867209c79b7e2c62ea039d066f89b5997422de1698ed5d256ac7de0cc20d1c0af07634c67879
- SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoL0JYH5:1dWubF3n9S91BF3fboYJYH5
- TLSH T1CC334A02EE8D88F5F145177038AA33B6953ABDE036996A931F53DDA5C87B370F12D242
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Gh0st RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
38440
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrlenA
lstrcpyA
FreeLibrary
GetProcAddress
LoadLibraryA
GetTickCount
WinExec
ReadFile
GetFileAttributesA
LocalFree
LocalSize
LocalAlloc
lstrcatA
GetCurrentProcessId
Process32Next
TerminateProcess
OpenProcess
Process32First
CopyFileA
GetModuleFileNameA
GetLastError
WaitForSingleObject
CreateProcessA
GetCurrentDirectoryA
FreeConsole
GetModuleHandleA
HeapAlloc
GetProcessHeap
VirtualProtect
HeapFree
InitializeCriticalSection
DeleteCriticalSection
CreateThread
LeaveCriticalSection
EnterCriticalSection
SetEvent
CreateEventA
WritePrivateProfileStringA
GetSystemDirectoryA
GetPrivateProfileStringA
lstrcmpiA
GetFileSize
CreateFileA
SetFilePointer
WriteFile
CloseHandle
Sleep
InterlockedExchange
VirtualAlloc
GlobalMemoryStatusEx
VirtualFree
user32
GetWindowThreadProcessId
GetLastInputInfo
wsprintfA
ChangeDisplaySettingsA
GetSystemMetrics
advapi32
RegQueryValueA
RegSetValueExA
RegCloseKey
CloseServiceHandle
ControlService
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegOpenKeyExA
shell32
SHGetSpecialFolderPathA
ole32
CoCreateInstance
CoInitialize
oleaut32
VariantClear
VariantInit
mfc42
ord825
ord823
msvcrt
_strupr
_strcmpi
_stricmp
_strnicmp
_onexit
??1type_info@@UAE@XZ
_beginthreadex
_errno
realloc
strchr
_adjust_fdiv
__dllonexit
_initterm
ceil
_ftol
__CxxFrameHandler
_CxxThrowException
_except_handler3
_local_unwind2
rand
strstr
strncpy
strrchr
free
malloc
printf
atoi
strcspn
wcstombs
urlmon
URLDownloadToFileA
ws2_32
connect
inet_addr
getsockname
WSAStartup
WSACleanup
closesocket
ntohs
listen
bind
socket
accept
htons
gethostbyname
sendto
recvfrom
__WSAFDIsSet
select
send
recv
getpeername
inet_ntoa
iphlpapi
GetIfTable
GetAdaptersInfo
DllUpdate
Install
MainThread
ServiceMain
Uninstall
Name
.text
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=12, version=7291,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=11, version=8047,
count=3, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=2, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=4, version=9782,
count=1, productName=Unmarked objects (old),
count=125, id=1, productName=Unmarked objects,
count=19, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=13, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
93388484.bat
- IMPHASH 4847c8aea5b26a115e9f4b1fffee02d5
- SHA256 4d413ed4dca5b41ca4935725ef10123b0f87dbb5e3eaef14d1ff5fbea42cc529
- MD5 ac2925c40cf76976d61c3eb8290efe7f
- SHA1 3e1fc4d31fcfdcdeb0b98a1b28e85a63e93300c7
- SHA512 faecbb329cb35047ad8d2c060fa2d207b01311443d8c08c56b6dd3fb4dbb8cfd565179d06a8af3eb5a4023a97fe213bda50bb3916feac44bcddae51cae3256c5
- SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLeJYH5:1dWubF3n9S91BF3fboKJYH5
- TLSH T1B4333A02EE8D88F5F145177038AA33B6953ABDE036996A931F53DDA5C87B370F12D242
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Gh0st RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
38440
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrlenA
lstrcpyA
FreeLibrary
GetProcAddress
LoadLibraryA
GetTickCount
WinExec
ReadFile
GetFileAttributesA
LocalFree
LocalSize
LocalAlloc
lstrcatA
GetCurrentProcessId
Process32Next
TerminateProcess
OpenProcess
Process32First
CopyFileA
GetModuleFileNameA
GetLastError
WaitForSingleObject
CreateProcessA
GetCurrentDirectoryA
FreeConsole
GetModuleHandleA
HeapAlloc
GetProcessHeap
VirtualProtect
HeapFree
InitializeCriticalSection
DeleteCriticalSection
CreateThread
LeaveCriticalSection
EnterCriticalSection
SetEvent
CreateEventA
WritePrivateProfileStringA
GetSystemDirectoryA
GetPrivateProfileStringA
lstrcmpiA
GetFileSize
CreateFileA
SetFilePointer
WriteFile
CloseHandle
Sleep
InterlockedExchange
VirtualAlloc
GlobalMemoryStatusEx
VirtualFree
user32
GetWindowThreadProcessId
GetLastInputInfo
wsprintfA
ChangeDisplaySettingsA
GetSystemMetrics
advapi32
RegQueryValueA
RegSetValueExA
RegCloseKey
CloseServiceHandle
ControlService
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegOpenKeyExA
shell32
SHGetSpecialFolderPathA
ole32
CoCreateInstance
CoInitialize
oleaut32
VariantClear
VariantInit
mfc42
ord825
ord823
msvcrt
_strupr
_strcmpi
_stricmp
_strnicmp
_onexit
??1type_info@@UAE@XZ
_beginthreadex
_errno
realloc
strchr
_adjust_fdiv
__dllonexit
_initterm
ceil
_ftol
__CxxFrameHandler
_CxxThrowException
_except_handler3
_local_unwind2
rand
strstr
strncpy
strrchr
free
malloc
printf
atoi
strcspn
wcstombs
urlmon
URLDownloadToFileA
ws2_32
connect
inet_addr
getsockname
WSAStartup
WSACleanup
closesocket
ntohs
listen
bind
socket
accept
htons
gethostbyname
sendto
recvfrom
__WSAFDIsSet
select
send
recv
getpeername
inet_ntoa
iphlpapi
GetIfTable
GetAdaptersInfo
DllUpdate
Install
MainThread
ServiceMain
Uninstall
Name
.text
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=12, version=7291,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=11, version=8047,
count=3, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=2, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=4, version=9782,
count=1, productName=Unmarked objects (old),
count=125, id=1, productName=Unmarked objects,
count=19, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=13, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
93417718.bat
- IMPHASH 4847c8aea5b26a115e9f4b1fffee02d5
- SHA256 4d413ed4dca5b41ca4935725ef10123b0f87dbb5e3eaef14d1ff5fbea42cc529
- MD5 ac2925c40cf76976d61c3eb8290efe7f
- SHA1 3e1fc4d31fcfdcdeb0b98a1b28e85a63e93300c7
- SHA512 faecbb329cb35047ad8d2c060fa2d207b01311443d8c08c56b6dd3fb4dbb8cfd565179d06a8af3eb5a4023a97fe213bda50bb3916feac44bcddae51cae3256c5
- SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLeJYH5:1dWubF3n9S91BF3fboKJYH5
- TLSH T1B4333A02EE8D88F5F145177038AA33B6953ABDE036996A931F53DDA5C87B370F12D242
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Gh0st RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
38440
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrlenA
lstrcpyA
FreeLibrary
GetProcAddress
LoadLibraryA
GetTickCount
WinExec
ReadFile
GetFileAttributesA
LocalFree
LocalSize
LocalAlloc
lstrcatA
GetCurrentProcessId
Process32Next
TerminateProcess
OpenProcess
Process32First
CopyFileA
GetModuleFileNameA
GetLastError
WaitForSingleObject
CreateProcessA
GetCurrentDirectoryA
FreeConsole
GetModuleHandleA
HeapAlloc
GetProcessHeap
VirtualProtect
HeapFree
InitializeCriticalSection
DeleteCriticalSection
CreateThread
LeaveCriticalSection
EnterCriticalSection
SetEvent
CreateEventA
WritePrivateProfileStringA
GetSystemDirectoryA
GetPrivateProfileStringA
lstrcmpiA
GetFileSize
CreateFileA
SetFilePointer
WriteFile
CloseHandle
Sleep
InterlockedExchange
VirtualAlloc
GlobalMemoryStatusEx
VirtualFree
user32
GetWindowThreadProcessId
GetLastInputInfo
wsprintfA
ChangeDisplaySettingsA
GetSystemMetrics
advapi32
RegQueryValueA
RegSetValueExA
RegCloseKey
CloseServiceHandle
ControlService
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegOpenKeyExA
shell32
SHGetSpecialFolderPathA
ole32
CoCreateInstance
CoInitialize
oleaut32
VariantClear
VariantInit
mfc42
ord825
ord823
msvcrt
_strupr
_strcmpi
_stricmp
_strnicmp
_onexit
??1type_info@@UAE@XZ
_beginthreadex
_errno
realloc
strchr
_adjust_fdiv
__dllonexit
_initterm
ceil
_ftol
__CxxFrameHandler
_CxxThrowException
_except_handler3
_local_unwind2
rand
strstr
strncpy
strrchr
free
malloc
printf
atoi
strcspn
wcstombs
urlmon
URLDownloadToFileA
ws2_32
connect
inet_addr
getsockname
WSAStartup
WSACleanup
closesocket
ntohs
listen
bind
socket
accept
htons
gethostbyname
sendto
recvfrom
__WSAFDIsSet
select
send
recv
getpeername
inet_ntoa
iphlpapi
GetIfTable
GetAdaptersInfo
DllUpdate
Install
MainThread
ServiceMain
Uninstall
Name
.text
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=12, version=7291,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=11, version=8047,
count=3, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=2, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=4, version=9782,
count=1, productName=Unmarked objects (old),
count=125, id=1, productName=Unmarked objects,
count=19, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=13, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
93999343.bat
- IMPHASH 4847c8aea5b26a115e9f4b1fffee02d5
- SHA256 f7ad65434397ae7e8ee10177f8e86fe4c05b560f98fa75aa62b24785cdc0880e
- MD5 ddaa2edb91310f1b379a72fdb59048d8
- SHA1 03cbdc4a15aeb2baf0c90ef808b4e8f31626a7ef
- SHA512 e6a0fb4bf46e678b1fd1c38fe58bb42e3b154b907c193a5c822a9a40206116ef2e90d5e0984156b4e148c31d6dd81772c6c690b5b7461df070687c8c6cde847f
- SSDEEP 1536:1WmqoiBMNbMWtYNif/n9S91BF3frnoLNJYH5:1dWubF3n9S91BF3fboJJYH5
- TLSH T1EE333A02EE8D88F5F145177038AA33B6953ABDE036996A931F53DDA5C87B370F12D242
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Gh0st RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
38440
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
kernel32
lstrlenA
lstrcpyA
FreeLibrary
GetProcAddress
LoadLibraryA
GetTickCount
WinExec
ReadFile
GetFileAttributesA
LocalFree
LocalSize
LocalAlloc
lstrcatA
GetCurrentProcessId
Process32Next
TerminateProcess
OpenProcess
Process32First
CopyFileA
GetModuleFileNameA
GetLastError
WaitForSingleObject
CreateProcessA
GetCurrentDirectoryA
FreeConsole
GetModuleHandleA
HeapAlloc
GetProcessHeap
VirtualProtect
HeapFree
InitializeCriticalSection
DeleteCriticalSection
CreateThread
LeaveCriticalSection
EnterCriticalSection
SetEvent
CreateEventA
WritePrivateProfileStringA
GetSystemDirectoryA
GetPrivateProfileStringA
lstrcmpiA
GetFileSize
CreateFileA
SetFilePointer
WriteFile
CloseHandle
Sleep
InterlockedExchange
VirtualAlloc
GlobalMemoryStatusEx
VirtualFree
user32
GetWindowThreadProcessId
GetLastInputInfo
wsprintfA
ChangeDisplaySettingsA
GetSystemMetrics
advapi32
RegQueryValueA
RegSetValueExA
RegCloseKey
CloseServiceHandle
ControlService
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegOpenKeyExA
shell32
SHGetSpecialFolderPathA
ole32
CoCreateInstance
CoInitialize
oleaut32
VariantClear
VariantInit
mfc42
ord825
ord823
msvcrt
_strupr
_strcmpi
_stricmp
_strnicmp
_onexit
??1type_info@@UAE@XZ
_beginthreadex
_errno
realloc
strchr
_adjust_fdiv
__dllonexit
_initterm
ceil
_ftol
__CxxFrameHandler
_CxxThrowException
_except_handler3
_local_unwind2
rand
strstr
strncpy
strrchr
free
malloc
printf
atoi
strcspn
wcstombs
urlmon
URLDownloadToFileA
ws2_32
connect
inet_addr
getsockname
WSAStartup
WSACleanup
closesocket
ntohs
listen
bind
socket
accept
htons
gethostbyname
sendto
recvfrom
__WSAFDIsSet
select
send
recv
getpeername
inet_ntoa
iphlpapi
GetIfTable
GetAdaptersInfo
DllUpdate
Install
MainThread
ServiceMain
Uninstall
Name
.text
Size
34KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=12, version=7291,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=11, version=8047,
count=3, id=14, version=7299,
count=4, id=10, version=8047,
count=2, id=4, version=8047,
count=2, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=2, id=4, version=9782,
count=1, productName=Unmarked objects (old),
count=125, id=1, productName=Unmarked objects,
count=19, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=13, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,
TXPlatforn.exe
- IMPHASH 19d4e66d725c89ba6712b82bebc8196d
- SHA256 57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd
- MD5 80ade1893dec9cab7f2e63538a464fcc
- SHA1 c06614da33a65eddb506db00a124a3fc3f5be02e
- SHA512 fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4
- SSDEEP 6144:BEo7J1ixs4uVKE9rFEAHKThrBSq2hAzSM5mDo9lSJULHZqExlD2E1LxhJVwIe0Dy:Wo2HQVWAHkFSq2hAWJYlMUtrxlyuJVRq
- TLSH T13A841221EB1265A2D30BB0F0CE685F0688B953584C6D1D57EEB51E2D7D3A3EDE832D06
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
369048
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetProcAddress
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameA
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetCurrentThreadId
TlsSetValue
TlsAlloc
SetLastError
TlsGetValue
GetLastError
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WriteFile
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetCPInfo
GetACP
GetOEMCP
HeapAlloc
VirtualAlloc
HeapReAlloc
LoadLibraryA
MultiByteToWideChar
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
InterlockedDecrement
InterlockedIncrement
Loader
Name
.data
Size
375KB
Virtual Size
375KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1024B
Virtual Size
752B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, id=11, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=20, id=14, version=7299,
count=58, id=10, productName=VS98 (6.0) SP6 build 8804, version=9782,
count=3, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=65, id=1, productName=Unmarked objects,
count=2, id=11, productName=VS98 (6.0) build 8168, version=8168,
count=1, id=6, productName=VS98 (6.0) SP6 cvtres build 1736, version=1735,
count=1, id=4, productName=VS98 (6.0) imp/exp build 8168,, version=8168,