gh0strat | f534f1f6e83a0f09ebdfd697b1e1a929db3cd597bbca593f660ca6bc3640bb41 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f534f1f6e83a0f09ebdfd697b1e1a929db3cd597bbca593f660ca6bc3640bb41
Size

504KB
MD5

2d7f0ff2870343d59d02b6b3b9038933
SHA1

b077729b41ccdbac9275ef08c7f0a4947b40fca4
SHA256

f534f1f6e83a0f09ebdfd697b1e1a929db3cd597bbca593f660ca6bc3640bb41
SHA512

6dd563ee6856f2c4f255521044797d977067fffb791f2cc809edcb7f7e432c21719e3a20ef2d90694261b7cec2f4024c43772bb8241eb3c3ef187723708b49a6
SSDEEP

12288:r6sPJlAghv3r+TsPdmfWfKtqgG5q1OEM5fLK:rLhlAghv3r+TsPdmcKUg4q0EM5f2

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

f534f1f6e83a0f09ebdfd697b1e1a929db3cd597bbca593f660ca6bc3640bb41
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 408KB - Virtual size: 407KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 473KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 28KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ