gh0strat | eb525407741a94174409997238890e530b2b8a1ed28402a131590fba4fc33bde | Triage

Sharing

Copy URL Twitter E-mail

General

Target

eb525407741a94174409997238890e530b2b8a1ed28402a131590fba4fc33bde
Size

204KB
MD5

04d6b96f4f2c6eed7c9156cfd2606ebc
SHA1

b1945a84f6d566133e09cb8c205b99aed553e877
SHA256

eb525407741a94174409997238890e530b2b8a1ed28402a131590fba4fc33bde
SHA512

53d96b65f5a5bb29ed644229b489e4c1a042f995f8b9681686dd5a52f05edf40ce4f747b4742ffdf5f92fcd13a7352dc9c99a1089ebc1f07abe8aacb4b6bc66b
SSDEEP

3072:uTeTY1Em5WBqwP3fsRQ/Xz7iastKyC/hX6hxv37ntmefw5tQ:uiTViWB0uL7thJ5sp37tY0

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

eb525407741a94174409997238890e530b2b8a1ed28402a131590fba4fc33bde
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 136KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.jiao
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.jia
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fao
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE