gh0strat | 17b4681af8788dded9da638c43933c4f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

17b4681af8788dded9da638c43933c4f
Size

104KB
MD5

17b4681af8788dded9da638c43933c4f
SHA1

d8720fbd018fd8b3906a8cb3ffc289babec7bc65
SHA256

79e95257cb2cee38632465f53af2e2355fd1733f84d6dc5b66f5013725ff6a64
SHA512

a9a019d8587c749238b0fe4b73d9be19f98c50b8a4361928db8e6892866f9b015b3a7812e1e527e6500107cea8e88c9099701b09af2ded05df88a254b705d826
SSDEEP

1536:n1d/ZKo1+V+78EBbpt/pxLkhM6dcMnyfha0/My1OaPHM/CW:1d/ZJ1Rn0M6dXnEha0Ey1OaPHM/CW

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17b4681af8788dded9da638c43933c4f

Files

17b4681af8788dded9da638c43933c4f
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

ServiceMain

Sections

.text
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ