gh0strat | 4dd49ffcbb126b27c5ac885f186a4060[.]exe | Triage

Sharing

General

Target

4dd49ffcbb126b27c5ac885f186a4060.exe
Size

324KB
MD5

4dd49ffcbb126b27c5ac885f186a4060
SHA1

0b52941d9a05ebb4001af23a82169abf69514f42
SHA256

becc6f8e5b34bc2ccac9d11b1dd7b62278f79ac242649d656278e3947a24f5e0
SHA512

20e6b24e4ff6d05e9bfffb8d1e8e798fe381dc8531fc8853ef553af9944d422df87cd7c6cc452373917da8cfa88cb4dc833b1729c0d02814b1ab1b31180421c6
SSDEEP

6144:LiTti+B0wL7t4J5Gp3ySYe04G7v4G7AWFQ:2PB0wd4rGN/PeJAN

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

4dd49ffcbb126b27c5ac885f186a4060.exe
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 136KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 136KB - Virtual size: 132KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ