gh0strat | b226ea072e74a3ba98ac7727012e98db8f8576321046e039f6afc5a80dd88c51 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

b226ea072e74a3ba98ac7727012e98db8f8576321046e039f6afc5a80dd88c51
Size

196KB
MD5

490effe020f054ccdb02c450a28e9f93
SHA1

086ca9a66d67376b6f7c852386c88e1aaf2b2dd8
SHA256

b226ea072e74a3ba98ac7727012e98db8f8576321046e039f6afc5a80dd88c51
SHA512

25302ef25ea2a8528cd4f88dc4fec999dee750ebeb2c5c82c72991ec1a5f00e4e8c6aa53f58a6c27d0ac8f1b692ad7ba907696485c7b5f046c2b3068c5105d26
SSDEEP

6144:IsItKnW8Q2BTyPRqyhYPbncTBlhHr6ndnG:NtW8CJq8YPbncT3

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

b226ea072e74a3ba98ac7727012e98db8f8576321046e039f6afc5a80dd88c51
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

CODE
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 166KB - Virtual size: 166KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata2
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE