gh0strat | 6800a318f9cbcb057672ecc0c7cb52aeeef6f9e3345ab8646a40edc8b2463a1a | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6800a318f9cbcb057672ecc0c7cb52aeeef6f9e3345ab8646a40edc8b2463a1a
Size

488KB
MD5

d2d53caff294b77e0da4f09d43f2295f
SHA1

8820cb67de9933aef08bcdc5e95bd9f555114b1a
SHA256

6800a318f9cbcb057672ecc0c7cb52aeeef6f9e3345ab8646a40edc8b2463a1a
SHA512

c1c15e22112073e8bf53dd051ac81beab9a6a56d02da23a3d8a57c0e891630eb0d3d734562dbd0f68be4a0c070239f30c1b4dd7bac5561649ed43fa32814ce48
SSDEEP

6144:DiTViWB0uL7tBJ59p37tYECOecc8/rsR3Xepr1SzbIYt0f9LevYg44h0:ePB0udBr9NJ+cc8/43XeB1SHI6swr44e

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

6800a318f9cbcb057672ecc0c7cb52aeeef6f9e3345ab8646a40edc8b2463a1a
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 136KB - Virtual size: 133KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 288KB - Virtual size: 287KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.jiao
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.jia
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.fao
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE