gh0strat | 9af533075b2d0fcf6b94e36b871f3905d3b2e3bf51300c7f02282dc072e225f3 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9af533075b2d0fcf6b94e36b871f3905d3b2e3bf51300c7f02282dc072e225f3
Size

633KB
MD5

f0878209862c549f77c2d4fbfb293a7c
SHA1

d0b14aea76fc5378da7e6c90f083b3280cba4de7
SHA256

9af533075b2d0fcf6b94e36b871f3905d3b2e3bf51300c7f02282dc072e225f3
SHA512

6e4934153a5b47d590db2cad8bbbed7f2a0d19e07227f754cb9e86a738433152e31522b60154f156893f57e16333f6858482185c001dd0c210e8baabd6adac1c
SSDEEP

12288:PcjrLQhTeGDF1r+TStBXvWyZ4uVNedGlHwM5dLFPMdCR:PcjeTeGDF1r+TStBXhZPVNXJwM5dJkd

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

9af533075b2d0fcf6b94e36b871f3905d3b2e3bf51300c7f02282dc072e225f3
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 487KB - Virtual size: 486KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 34KB - Virtual size: 502KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 111KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

��е۹�
Size: 512B - Virtual size: 512B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE