gh0strat | aed7bb99f9b317945bc8226907e30bd8737ca9008fe617bdc97188b7c9d2f7d3 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

aed7bb99f9b317945bc8226907e30bd8737ca9008fe617bdc97188b7c9d2f7d3
Size

436KB
MD5

fcf705ecf06e5d76827659d3e569318c
SHA1

2b226caa50c14f3bf939d4e2a8c8821ded0c1d96
SHA256

aed7bb99f9b317945bc8226907e30bd8737ca9008fe617bdc97188b7c9d2f7d3
SHA512

046cf82c009d8ec4e3657c5af7cc182b453ef9c95f306a6adfbc036fd0f8d9b25e57dbbb65fe0de3282ad628fa556e6046842edaa6e458318f74074d5bd4b30b
SSDEEP

12288:TUek4G2mVM10UYcz9mVM10UYcYiQIviQ1O:TC4G2mG10/kmG10/x3Iv31O

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

aed7bb99f9b317945bc8226907e30bd8737ca9008fe617bdc97188b7c9d2f7d3
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 257B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 427KB - Virtual size: 428KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

IrStarPt
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE