gh0strat | 8d3ca78b830211b97f50b7e2ccd0040d | Triage

Sharing

Copy URL Twitter E-mail

General

Target

8d3ca78b830211b97f50b7e2ccd0040d
Size

101KB
MD5

8d3ca78b830211b97f50b7e2ccd0040d
SHA1

23e9b078484adbe62e3b3e3bcb816b60b0327d20
SHA256

ea1cea6ae0d4321d7af7fda7f5ca2a3d8632efbdd69454297fa99ea1e315c58b
SHA512

fa5a7fd2cf6645382e588f4cf960f325c67cddbcebdf5d44935d0b46a6b517c739e30f693c11b6e45fda92a5d105aa17774fc2e92b0aa0d0561f28b998a11225
SSDEEP

3072:bHvzJT1wQkNpvgPC4WaGCfO74W9CD5zCs6o:LvMvqCvWO74WWzC

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8d3ca78b830211b97f50b7e2ccd0040d

Files

8d3ca78b830211b97f50b7e2ccd0040d
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

JustforFun1
JustforFun2
JustforFun3
Rool
ServiceMain
whmtorrent
wwhhmm

Sections

.text
Size: 70KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Torrent
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ