gh0strat | e0caef3c75a9a9c1431b2a0112d308d1 | Triage

Sharing

General

Target

e0caef3c75a9a9c1431b2a0112d308d1
Size

1.2MB
MD5

e0caef3c75a9a9c1431b2a0112d308d1
SHA1

db6c15ba4b1c1bae43b9510cdcf8299030f36bf0
SHA256

bcf33079c39fd5d5b10af88d7ef7bbb7083bae9f1f3621e04f4f91bb1b6181fe
SHA512

60e0a8f4861f349c2341ccaa91dd1571d41f966d2353f04eb3217145f94ec88f0740d9dd45de4d4f18a508d3084c3d4b07f252c1b8b3352d3da34386929f2990
SSDEEP

24576:85QIzHyuhiDyrP15QIzHyuhiDyrP1QeIaM:85p6iP15p6iPSWM

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e0caef3c75a9a9c1431b2a0112d308d1

Files

e0caef3c75a9a9c1431b2a0112d308d1
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI

Sections

CODE
Size: 342KB - Virtual size: 342KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

DATA
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

BSS
Size: - Virtual size: 3KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: - Virtual size: 16B

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 184KB - Virtual size: 183KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ