gh0strat | 30e40f808892038e8f278fb212c5330eec95ac07459e3bf30ff07b74c16be309 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

30e40f808892038e8f278fb212c5330eec95ac07459e3bf30ff07b74c16be309
Size

763KB
MD5

f817b506115e519a45e0c3d2bb506d50
SHA1

5d98aa87024797fb4b5b31d6285de6b0a6820e1a
SHA256

30e40f808892038e8f278fb212c5330eec95ac07459e3bf30ff07b74c16be309
SHA512

21df3e49c6d637ebd887a0f36a9fe715c958544a97870808c37caaac184f1f3748f4897bce2598e73daf35ad00e18cb8150a1d94f9a738caac7593528e58733b
SSDEEP

12288:JzQr+1kZVQQxfnr+TK7r79/JDXWE18qRzfG4M5KC7ocJ:RQKQVQQxfnr+TK7r79/JD71PRi4M5KCF

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

30e40f808892038e8f278fb212c5330eec95ac07459e3bf30ff07b74c16be309
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 412KB - Virtual size: 409KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 474KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ