gh0strat | 404231efe954c54fad96006b53437bd4618a7a2473e225500d0f0078136d5f03 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

404231efe954c54fad96006b53437bd4618a7a2473e225500d0f0078136d5f03
Size

825KB
MD5

9318115eafd81568f81cf1c312fe6b3d
SHA1

0dd94ff713fc12f6359e431125242917e8edf98d
SHA256

404231efe954c54fad96006b53437bd4618a7a2473e225500d0f0078136d5f03
SHA512

43d627e26b6d77607080891ec472ecfddb8f64a15bcb49d696ecc387e99757ecba7aaa3ef1a1dad83d1a335eb9227ef1bedb6a81844f7eb1a3a5cb38dc447938
SSDEEP

24576:ueUyhFaFtS+yr+TRIbWc2yEKiNT65ql5/mdD0M:Zhsl5/mn

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

404231efe954c54fad96006b53437bd4618a7a2473e225500d0f0078136d5f03
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 448KB - Virtual size: 445KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 491KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 288KB - Virtual size: 288KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ