gh0strat | 9fa6ae34daf52b5e222f40192ea3b270d7bf43c0c38553da16e11727bb4a04c9 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

9fa6ae34daf52b5e222f40192ea3b270d7bf43c0c38553da16e11727bb4a04c9
Size

783KB
MD5

ed13231af416179e07e1333798a30eb6
SHA1

79f465f8cf0d042a4c2402dfc0a8e72d02abc64e
SHA256

9fa6ae34daf52b5e222f40192ea3b270d7bf43c0c38553da16e11727bb4a04c9
SHA512

c4833ec7f62dc9b2e89b37f8a3e82065bb8b66a8748ebcfbb3b5edec0aaf5dabb51dd52e66b8f4fa6e0406d384aadeb11aaa20a0bbc0c7b4fb53e345cb74e5ed
SSDEEP

12288:jfoZQG1PyUwGh3Q9xRQpR3PvGLxe0DMwRoZQp1PyUwGhxYV:Tod1twGwkR3PIx7DBoe1twGC

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

9fa6ae34daf52b5e222f40192ea3b270d7bf43c0c38553da16e11727bb4a04c9
.exe windows x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.!rc!
Size: 171KB - Virtual size: 176KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

ChW8avWh
Size: 3KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

OZNFY7Rg
Size: 300KB - Virtual size: 304KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

IHJ3KUI5
Size: 294B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

0ICFj14c
Size: 23KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.AoRE
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 279KB - Virtual size: 279KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ