gh0strat | f4cd48937c0a44e9cca159c756c7bdc3036e320f2cb06cbdce926d7200182b2c | Triage

Sharing

General

Target

f4cd48937c0a44e9cca159c756c7bdc3036e320f2cb06cbdce926d7200182b2c
Size

464KB
MD5

9c7ad70726381e71c212a544847c42b5
SHA1

7d1d0a486a0181e29a3e1f2929e9e168dd7ebc3f
SHA256

f4cd48937c0a44e9cca159c756c7bdc3036e320f2cb06cbdce926d7200182b2c
SHA512

03ddeb5861db9dfa822985341d103bdabc32f7524b9ad9457792b786dfc7603759a3b33946a65138b1dd36fefb8a028d2a54f992a088b837112c0aa2604a3d40
SSDEEP

12288:UigdXGKnZZghbU14KF0RZtYj2x7DgalsrZFVhPzpY:DgdXhnZZubS4K6ftJ7D9qNFVDY

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

f4cd48937c0a44e9cca159c756c7bdc3036e320f2cb06cbdce926d7200182b2c
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.textbss
Size: - Virtual size: 128KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 457KB - Virtual size: 460KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 267B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ