gh0strat | ce32a420e2a7cbf1d051324ad2f528811fa52a5c0435dd6e8474937eeccda1fa | Triage

Sharing

Copy URL Twitter E-mail

General

Target

ce32a420e2a7cbf1d051324ad2f528811fa52a5c0435dd6e8474937eeccda1fa
Size

132KB
MD5

723478804cfb004f25f3793170f1b8a9
SHA1

e03d1912c5aef2ac3edc02cf08e31a05ba5a8a04
SHA256

ce32a420e2a7cbf1d051324ad2f528811fa52a5c0435dd6e8474937eeccda1fa
SHA512

9a59296a4e7c39349e91fd62552113a7dc5e27da7604dba8e48d349f42b223eaa10c632110098d078ef0e33d44b6b1c11deb0ed9eabb19b490f1ffbe20c2a87e
SSDEEP

3072:czk9z4Uh+yQAbAbuDNWtMpebime67kywjsgu:7DTQAbzMbxX7kywjI

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

ce32a420e2a7cbf1d051324ad2f528811fa52a5c0435dd6e8474937eeccda1fa
.dll windows x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

EndWork
Runing
ServiceMain
Working

Sections

.text
Size: 84KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

NewSec
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE