gh0strat | 4422b9adf033a3a550e8104dc9a09b2a14bc809119de1fcc89bc850f90daf07e | Triage

Sharing

General

Target

4422b9adf033a3a550e8104dc9a09b2a14bc809119de1fcc89bc850f90daf07e
Size

313KB
MD5

343970152974787fcd3fa6aca31359d3
SHA1

50e30e96a20e22e1885423b722a9b8ada981408a
SHA256

4422b9adf033a3a550e8104dc9a09b2a14bc809119de1fcc89bc850f90daf07e
SHA512

58fc1b242855b578172cdc9f54acc1085a921554899a52481ab13c8137c57d52d3fe1cc050ebd6ad9792da6cf7eb1a383b9676c1015ddc35377ee0d3a28d370e
SSDEEP

6144:pmVKUv8vtQse2GoH1LbtF77OUSSXmUzZ0GkrBzIIL/7NOW:ksvtQsKothF7nSGxzmTB//7QW

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

4422b9adf033a3a550e8104dc9a09b2a14bc809119de1fcc89bc850f90daf07e
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 100KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 12KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 4KB - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.wtq
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE