gh0strat | 64950611efa3c77a0ab71ef57e85d459958f2cfbf536ef0dccb17d5e46ed46b9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

64950611efa3c77a0ab71ef57e85d459958f2cfbf536ef0dccb17d5e46ed46b9
Size

204KB
MD5

a207d99f6a1e3d9ee1f97b3b1f7d15f0
SHA1

ca35e1c96e2201effb316940ac7f4925f839c7ce
SHA256

64950611efa3c77a0ab71ef57e85d459958f2cfbf536ef0dccb17d5e46ed46b9
SHA512

55563c85ebdbd13a4688f7ce98e76481db009e6e6181a2b4b153f17d8618122cfb20b342702474073df302714c0a62c268e7895cb1162d9a14a1b3288055ba2d
SSDEEP

1536:CezCNkHjYj1BgGkcfjFbW4crqwPSufn8IlhRQ/cAzrfias3K5Ji/qRvTuwh:CeTY1Em5WBqwP3fZQ/Xz7ias3KyC/h

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

64950611efa3c77a0ab71ef57e85d459958f2cfbf536ef0dccb17d5e46ed46b9
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 136KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.jiao
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.jia
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fao
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE