gh0strat | c5186c2b691b4f7caa9ea6561e761a376f3fbaa616e4eccebf347807cad0a015 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

c5186c2b691b4f7caa9ea6561e761a376f3fbaa616e4eccebf347807cad0a015
Size

148KB
MD5

a179b61bce3ae3ed6951138182f892e3
SHA1

09c048dca83bacfe77a20372ff002d7b83cef391
SHA256

c5186c2b691b4f7caa9ea6561e761a376f3fbaa616e4eccebf347807cad0a015
SHA512

d0c4e5aea644cb9bc835788e7caea62b7d7e363619af4798d206b46e025dd6b658719e4ae6c6e3539657cb8192a3b7d03b9362ffbec433cc902b9f62e772d64d
SSDEEP

3072:WG9vTbZkEWg/5y14kquZ2WRDiPBPTBft82I9+SZx:WgvfRH/g1p7hiPBPTBl82I9+SZ

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

c5186c2b691b4f7caa9ea6561e761a376f3fbaa616e4eccebf347807cad0a015
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

FreeTest

Sections

ssss
Size: 96KB - Virtual size: 93KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

uuuu
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

pppp
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

eeee
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

rrrr
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ