gh0strat | 080c99988f3ff46ad15a525e2185ea958bbe0ec2513818a2ae5c8328808fee78 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

080c99988f3ff46ad15a525e2185ea958bbe0ec2513818a2ae5c8328808fee78
Size

242KB
MD5

50acf599bedf263955df95535ed1e2db
SHA1

c3dc05eee8d612aa765041686bc41ffeda95e690
SHA256

080c99988f3ff46ad15a525e2185ea958bbe0ec2513818a2ae5c8328808fee78
SHA512

d2a52de8315540e30b9560399cf2085611e7576b11dd172c4fb93c1c0759bcdaa0ba7b03a8ecaecaa5be306d9cb0d995cab9025e65785cb7dfd5ee223811b35f
SSDEEP

6144:7DTQAbzMbxX7kywdIGeqoQYZABlCZzqRRJ:7DxqX4ejcl1RJ

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

080c99988f3ff46ad15a525e2185ea958bbe0ec2513818a2ae5c8328808fee78
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

EndWork
Runing
ServiceMain
Working

Sections

.text
Size: 84KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

NewSec
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE