gh0strat | 925383c82e2b5dd4aa6b23f7d7461cb646aeb20291b735586173726ed2cec04b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

925383c82e2b5dd4aa6b23f7d7461cb646aeb20291b735586173726ed2cec04b
Size

489KB
MD5

ebd1a404e88ab1d14fa9e969e65696a2
SHA1

17bfec4026822b2a47068188e8520bc061b18b92
SHA256

925383c82e2b5dd4aa6b23f7d7461cb646aeb20291b735586173726ed2cec04b
SHA512

b240ffc1e4d6e2691bb81615471d6707e4279bfb1428aea4a6ee6becbf350115b7b8c9fac94af8c7948347b74ceff63e42ef33d3ffb595012eb619f86fd870d2
SSDEEP

12288:1OcGZVQQxfnr+TK7r79/54rWulAXc5lwNeM5kEw:QZVQQxfnr+TK7r79/545lKccNeM5kEw

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

925383c82e2b5dd4aa6b23f7d7461cb646aeb20291b735586173726ed2cec04b
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 412KB - Virtual size: 409KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 474KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ