gh0strat | 5c09759edd469e9814d8ea4a02fa9e1a4a661001c1238c95bb2bb9c610d44aec | Triage

Sharing

Copy URL Twitter E-mail

General

Target

5c09759edd469e9814d8ea4a02fa9e1a4a661001c1238c95bb2bb9c610d44aec
Size

112KB
MD5

6fc425b42d2253ecd2339ad2a80c1670
SHA1

31b7ccb278f2f39b10af2f23683b4c182bf58cb3
SHA256

5c09759edd469e9814d8ea4a02fa9e1a4a661001c1238c95bb2bb9c610d44aec
SHA512

f3174dcf2e56b4fe4edaee699f18bb161dd53ed652469a08f355da62ecdd8ac805d2cd442f6cba8d3bb49bc2a4b1bc7743b79965cd017fa176774d9f560f1dc7
SSDEEP

1536:meQnWtkbd7qayRqsl9Bec9e2f6aeG1TLM5EC8iTy7l7Ewq:9QWtw0X9Beeeg6aeR5TtTyB7E

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

5c09759edd469e9814d8ea4a02fa9e1a4a661001c1238c95bb2bb9c610d44aec
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

ServiceMain

Sections

.text
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 11KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.mackt
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE