gh0strat | 33feebf8ac8c107950f28f9e781a72210830b4190df1928f0c8df2f0aecdb6f5 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

33feebf8ac8c107950f28f9e781a72210830b4190df1928f0c8df2f0aecdb6f5
Size

985KB
MD5

0091d4879c7021c2234a8318229b09d0
SHA1

cec49d6a1bdcecbb2ae58f3a0f159e1c04c44281
SHA256

33feebf8ac8c107950f28f9e781a72210830b4190df1928f0c8df2f0aecdb6f5
SHA512

79f213affb52fd4269043d1984b0e4b74641aadde1dcc793226eb1628d999186ef13d215bdae44a2987b6451e1454e3dd5aee6f8d69f6d0a4ff7c7da8043b3f4
SSDEEP

24576:Yod1twGwkR3PIx7DBoe1twGCLzNys6FkC:lDw+CnDOy

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

33feebf8ac8c107950f28f9e781a72210830b4190df1928f0c8df2f0aecdb6f5
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.!rc!
Size: 171KB - Virtual size: 176KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ChW8avWh
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

OZNFY7Rg
Size: 300KB - Virtual size: 304KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

IHJ3KUI5
Size: 294B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

0ICFj14c
Size: 23KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.AoRE
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 279KB - Virtual size: 279KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.xur
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE