gh0strat | eab53880833771bbbc0cac31ffb900aff4f34cbb9a3e82431ef3f89dd9c46b15 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

eab53880833771bbbc0cac31ffb900aff4f34cbb9a3e82431ef3f89dd9c46b15
Size

785KB
MD5

075481833b169debcf007aa1c52d5f3d
SHA1

9b1c49cd3e83d32cad896fa17a203d8caa8e8755
SHA256

eab53880833771bbbc0cac31ffb900aff4f34cbb9a3e82431ef3f89dd9c46b15
SHA512

56f37ac9999fc18c56cb8fc974a03be97a9d3ccec45f073756e0870467d9abc972ed6eb94f7203a897f8c70e338774c930059ebd6bfc0e71f99e52d6501c4578
SSDEEP

12288:dfoZQG1PyUwGh3Q9xRQpR3PvGLxe0DMwRoZQB1PyUwGh7YV:xod1twGwkR3PIx7DBoq1twGY

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

eab53880833771bbbc0cac31ffb900aff4f34cbb9a3e82431ef3f89dd9c46b15
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.!rc!
Size: 171KB - Virtual size: 176KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ChW8avWh
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

OZNFY7Rg
Size: 300KB - Virtual size: 304KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

IHJ3KUI5
Size: 294B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

0ICFj14c
Size: 23KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.AoRE
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 282KB - Virtual size: 284KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ