gh0strat | 5af18c3873412a70cced47b9456fba9c | Triage

Sharing

General

Target

5af18c3873412a70cced47b9456fba9c
Size

890KB
MD5

5af18c3873412a70cced47b9456fba9c
SHA1

0854ae1d604e80f53bc4830e1bf78c6eed18eb7d
SHA256

42d220738a2c995c943a332250d5bbfb86fd344e34f008102c6e78ac1f101611
SHA512

51a5cc4476085a8c42201e760786457b68853ed62cf3bfc24e9e9001cb91c03ba452e6b75ba3e7d7f9d385c28a66c7bb5db69881e82b1a847e9eb0e2b406b1fd
SSDEEP

24576:mQKQVQQxfnr+TK7r79/JD71PRi4M5KCGsx:gvB

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5af18c3873412a70cced47b9456fba9c

Files

5af18c3873412a70cced47b9456fba9c
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 412KB - Virtual size: 409KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rodata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 474KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ