gh0strat | 65b48f146b8ac8f621f3939865b11a86ee2d16f611988c4d0807a0b90f2f12d7 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

65b48f146b8ac8f621f3939865b11a86ee2d16f611988c4d0807a0b90f2f12d7
Size

634KB
MD5

8e1ab623b6b73a1d3a5b13918299f984
SHA1

3d8caeddf401d1ca2163ada3f7d01c0587929c56
SHA256

65b48f146b8ac8f621f3939865b11a86ee2d16f611988c4d0807a0b90f2f12d7
SHA512

d579b3dcfebcb19e7c65c8734cca700c9d56ebf1d59df1d38170c5ed3a3b3fdea2bf3a21c8057c5120a76e2422aea07b8fec306e23296dec797a9a52e475386e
SSDEEP

12288:4cjrLQhTeGDF1r+TStBXvWyZ4uVNedGlHzM50LFPMdCR:4cjeTeGDF1r+TStBXhZPVNXJzM50Jkd

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

65b48f146b8ac8f621f3939865b11a86ee2d16f611988c4d0807a0b90f2f12d7
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 487KB - Virtual size: 486KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 34KB - Virtual size: 502KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

��к��
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE