gh0strat | 49160a879eb3c93b339446ba7f9094dca9a1d1ec14b4f8eaf4d99172409fe410 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

49160a879eb3c93b339446ba7f9094dca9a1d1ec14b4f8eaf4d99172409fe410
Size

660KB
MD5

a26de115bcc1b48aba8d3a59f7548ae0
SHA1

d67c369f5e3beceda65afd1427d4891e65e50e23
SHA256

49160a879eb3c93b339446ba7f9094dca9a1d1ec14b4f8eaf4d99172409fe410
SHA512

327b7585bdf8b61a55e97abfc1a5d816f909659ff6ece8aff9fec7f2bf788c492fc2f84c0df69821a5bc94d332ba95c6ef1d7f26762787d5acdd0109e2350206
SSDEEP

12288:JzQr+1kZVQQxfnr+TK7r79/JDXWE18qRzfG4M5KC7aHANUTNl:RQKQVQQxfnr+TK7r79/JD71PRi4M5KCE

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

49160a879eb3c93b339446ba7f9094dca9a1d1ec14b4f8eaf4d99172409fe410
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 412KB - Virtual size: 409KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 474KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ