gh0strat | ce4c2900e42a495e705ae2a9a5ca5361a595736d554436f6deb7c1f349d3e408 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ce4c2900e42a495e705ae2a9a5ca5361a595736d554436f6deb7c1f349d3e408
Size

102KB
MD5

785d2b07aef5da3e555e56ce4f4d586e
SHA1

a64f9e806b6768070c5320f095e7c772abc25ebf
SHA256

ce4c2900e42a495e705ae2a9a5ca5361a595736d554436f6deb7c1f349d3e408
SHA512

7bede9ca2ed4712eb37c8b1655b891d36530e81b892d7fc473a90294bef04f550e647b9b3b1fa5e27b025adbde03136e446f7eb63b37644cae74d04295fb73e7
SSDEEP

1536:6Msa6kRfJirY84erfImafc61JfcUcKDRAy:6Va6wiraf91JcUc2

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

ce4c2900e42a495e705ae2a9a5ca5361a595736d554436f6deb7c1f349d3e408
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

9
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ