gh0strat | 76669a2679e96ecc1003c4257b900709c590d5fa55bf1a3f16776a0091b68f95 | Triage

Sharing

General

Target

76669a2679e96ecc1003c4257b900709c590d5fa55bf1a3f16776a0091b68f95
Size

583KB
MD5

6cfce1f3d5f885e76a74f0e67af3858f
SHA1

0b85237bb5af7cdda82f7d9aac565e1ec2a3f9a3
SHA256

76669a2679e96ecc1003c4257b900709c590d5fa55bf1a3f16776a0091b68f95
SHA512

02ffed643fb9c2f522c6a524766c96b633c2e6634ee6f54251c5f88730dd4ea727ebb18ae36990af37db696401e844521f3954708c31e36932178cb5bb28a561
SSDEEP

12288:7q6ckRZVQQxfnr+TK7r79/ZzrWAVe7CmackyC3lc5i4yGqq5x:7q6cKVQQxfnr+TK7r79/ZzvVsFRkz3lQ

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

76669a2679e96ecc1003c4257b900709c590d5fa55bf1a3f16776a0091b68f95
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 410KB - Virtual size: 409KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 41KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 474KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 109KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ