gh0strat | 2f2dcea96b36ab532d9b543f98fd370c493b03de01cc964b9e09a013c9492bea | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2f2dcea96b36ab532d9b543f98fd370c493b03de01cc964b9e09a013c9492bea
Size

502KB
MD5

256a2adf5d804400caba62a3538f5410
SHA1

ff037b5b3634de8df313a219660bdd7eb01cdf4d
SHA256

2f2dcea96b36ab532d9b543f98fd370c493b03de01cc964b9e09a013c9492bea
SHA512

d0f0f8aa6de049c0864f73e42d5ef47d48f447e4c89201e294afa0a78562d3fa2322eaa6612a64e333948e54552e6db04f0d70ce8073275dcdceb7a5c0583b5a
SSDEEP

12288:MAfta46pFgABPXr+TMv9BLW6CmMm1lRyHM58:TtUFgABPXr+TMv9B5C21iHM58

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

2f2dcea96b36ab532d9b543f98fd370c493b03de01cc964b9e09a013c9492bea
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 400KB - Virtual size: 398KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 471KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ