gh0strat | 553f8fd23d4712667be345a73f916864 | Triage

Sharing

General

Target

553f8fd23d4712667be345a73f916864
Size

111KB
MD5

553f8fd23d4712667be345a73f916864
SHA1

1835cee7c20b0a239052b54bc65d1c3dc204bf5a
SHA256

2b129ee6241ea99aeeb8bdb7470fe1935828272a128bb0e4fca243272208124f
SHA512

93ed8c9036d2b59799a3cb3e4391e1b7429adb96694718e3f81273703f8daf84317a8af6d25568baded0996294964b38c06307bd1715c79bfb0fbacf50115e21
SSDEEP

1536:hGbWgROUOCgomc6VlhpMXlLzhcMq/fG78HTo1tvr17mPa3s1sDUv:hihOkFj6/huzhHqnG78stvR7mPa3s1gK

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
553f8fd23d4712667be345a73f916864

Files

553f8fd23d4712667be345a73f916864
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 2KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 83KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

XJ
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE