gh0strat | 74e23fbae264afdb11cf9382a81952e10563e9981a39839a302c3da954aa4432 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

74e23fbae264afdb11cf9382a81952e10563e9981a39839a302c3da954aa4432
Size

277KB
MD5

4c7be40f843904059347308b5fe0afa9
SHA1

6c3fb34df2f277461177b4696fc1b7cae8201472
SHA256

74e23fbae264afdb11cf9382a81952e10563e9981a39839a302c3da954aa4432
SHA512

444f7b53803623d7e09ddbd4951bd49ad9710e412055de8c6d212213918dc497879b90ae58571ae26103acd092936970af0130882bbf9e0b6af8c176271f5aaf
SSDEEP

6144:y7heYaKkA3dY44QXT80rSxTMwzKXYqPNhHWX5+tSHNySJO:y7heatV4QXT80raY1PP2X5+otySg

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

74e23fbae264afdb11cf9382a81952e10563e9981a39839a302c3da954aa4432
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 48KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

hwypqyo
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.lif
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE