gh0strat | 1a793948b35b62fe79fe25695128b24b1e130b8eb43411214442aa67243f71c2 | Triage

Sharing

General

Target

1a793948b35b62fe79fe25695128b24b1e130b8eb43411214442aa67243f71c2
Size

93KB
MD5

da9c4978c8de2b4d350c26f884f53e40
SHA1

777f74ca7665383c4120144875229a699fa66e66
SHA256

1a793948b35b62fe79fe25695128b24b1e130b8eb43411214442aa67243f71c2
SHA512

c26d9830bbdf8b6e86478594bc6808b78969864cb7a8bf7eac83d89b55e26780284c4b14e9f51430fa227bb2c9577da5c733584ac5e3a0223dcd40082833f637
SSDEEP

1536:eGuWHdEVDuhtaF3Tir5bqX/VOgVrNW5QDY+o8AS9ZIKF:eBWHWVKhqOO/VRVrNYQkCA+HF

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

1a793948b35b62fe79fe25695128b24b1e130b8eb43411214442aa67243f71c2
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 28KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 12KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE