gh0strat | 08f6494a3dd3119424d0075053219f6454ff6f9fc2a4ea3a85d1cda0f7ff6aab | Triage

Sharing

Copy URL Twitter E-mail

General

Target

08f6494a3dd3119424d0075053219f6454ff6f9fc2a4ea3a85d1cda0f7ff6aab
Size

200KB
MD5

680476dafb74b75feeace00ea6883596
SHA1

87c0ccb4b0122f4c0a5257006572f05c6c8c64c5
SHA256

08f6494a3dd3119424d0075053219f6454ff6f9fc2a4ea3a85d1cda0f7ff6aab
SHA512

954fb865d630ff214f88725fce91fb36bf42a396656514152718c6105689e9c15cf279067a94c7dbf0760f67c9ecfc0ea5480230f86642c8a51d0e0d3f23ce22
SSDEEP

6144:RUztArANBxIxh0u4TSg7vECzcx07Rpgp5J:RUzWANBxI/RJgDvn9Y5J

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

08f6494a3dd3119424d0075053219f6454ff6f9fc2a4ea3a85d1cda0f7ff6aab
.exe windows x86

536c35e361b8b671498d1baf00bbbda5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFree
VirtualAlloc
ExitProcess
GetProcAddress
LoadLibraryExA
GetModuleHandleA
VirtualProtect
GetModuleFileNameA
GetLastError
CreateMutexA

user32

MessageBoxA

Sections

.data
Size: - Virtual size: 204KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_cod
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 190KB - Virtual size: 190KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ