gh0strat | 87c5e005949141741b69492c8dbcf9705933eeb0378e08d498c663dc201f5bf3 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

87c5e005949141741b69492c8dbcf9705933eeb0378e08d498c663dc201f5bf3
Size

241KB
MD5

e68bf4c9bbd68f1ffd209d76fde7b41a
SHA1

2083df9c50f220708398df52c4cee260f51e92bc
SHA256

87c5e005949141741b69492c8dbcf9705933eeb0378e08d498c663dc201f5bf3
SHA512

cdd048e98ffca291df047f282b04764a592798764d79d023e9f9a62f9a1c5ad4ef202a0c0afeae6ccdbe66f82697f6e0f9fed18d83e12eccb52f1fe3c9a8341e
SSDEEP

6144:2pW1rdLmcnZrN26YU8jdRO286Dal+g7gr5d9HlTFph:2pAmerNxYhriiM+gidpnz

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

87c5e005949141741b69492c8dbcf9705933eeb0378e08d498c663dc201f5bf3
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 25KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xur
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE