gh0strat | 6fffcb1ccf8e7f38cf8e59e050d056ac | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6fffcb1ccf8e7f38cf8e59e050d056ac
Size

131KB
MD5

6fffcb1ccf8e7f38cf8e59e050d056ac
SHA1

4b5442805f24bc7697c42c3bc700bfbc6a6b71b8
SHA256

b361b2bd179cedad9a19272cb97a0f7e7032835711d3f536063bf1c9bd4a4e07
SHA512

af6428bae7e60faa528d62eb2279a5a6037342f3d5020762b779549a5abeecfe9311566ea27098e82baf6175a37d8ade263aba0ef27b8f1c5ce346eebf5027ed
SSDEEP

3072:gu+SqlgByBTEur7VsuRh/DBiE/8bNJFXaccx+tJdnJ0:gwDyBTE0V1LDw5N3KccqJdnJ0

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

6fffcb1ccf8e7f38cf8e59e050d056ac
.exe windows:4 windows x86 arch:x86

Code Sign

2e:9f:8f:23:a1:3b:7d:05:05:7b:bd:02:e4:8f:01:e9:26:3b:36:9e
Signer

Actual PE Digest

2e:9f:8f:23:a1:3b:7d:05:05:7b:bd:02:e4:8f:01:e9:26:3b:36:9e

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

INIT
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ