gh0strat | 95565ecbb370151dac30e0a3f2d3985ca691c955219dea04ea017d2d546110a2 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

95565ecbb370151dac30e0a3f2d3985ca691c955219dea04ea017d2d546110a2
Size

315KB
MD5

eb6a2a41bb3c029cbe9c3edad511daa9
SHA1

5e8d12f7fe079aa17b1c877b1b4a97a1af242972
SHA256

95565ecbb370151dac30e0a3f2d3985ca691c955219dea04ea017d2d546110a2
SHA512

f9c3bfd1afdbfbf5b483df7ca8ff9720a428e6f75f352141e1e507e62313c47e20f410b9bd23efa0a10db06f624f96071f6e89ef767e6deda4802963c7daa305
SSDEEP

6144:TVGgdx9tSUEZuwyrGXGqoA8nT+6eyW9Qmfy:TICdSU6s/JnTFeyW97y

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

95565ecbb370151dac30e0a3f2d3985ca691c955219dea04ea017d2d546110a2
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 143KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.sg
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.asef
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE