gh0strat | 2026-05-18_419b5371c5b03313d1c8c50569243a11_elex_gh0st-rat_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-05-18_419b5371c5b03313d1c8c50569243a11_elex_gh0st-rat_wannacry
Size 24.9MB
Sample260518-jy5krshv21
SHA256 85f9787f833c41e77c4475ef84bbc043393c682ed35662cb2629f110b6456f97
MD5 419b5371c5b03313d1c8c50569243a11
SHA1 fc7709203c8b7301f52119692b9030bd9111a9f3
SHA512 877b5de7c8191dc729a8a306e2f06bcfa655ac6eced860ab62bd5278b6b87a25e5e6422a9f91c2c4dae1ef022891175397e0a5adb7c7cad9304fef1dc2ccddb6
SSDEEP 6144:/sIZ6nW8QCBTyPRqyhYPbncTBlhHr+ndnkv0oXo:URW82Jq8YPbncT3ZC
TLSH
T12A479E83EB8148FAC8DD167850BAA77A3A3B9A500B181FC7B750DFF014E31515A3BD96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat gh0strat

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-05-18_419b5371c5b03313d1c8c50569243a11_elex_gh0st-rat_wannacry

File Explorer

2026-05-18_419b5371c5b03313d1c8c50569243a11_elex_gh0st-rat_wannacry

.exe 24.9MB

2026-05-18_419b5371c5b03313d1c8c50569243a11_elex_gh0st-rat_wannacry

SHA256 85f9787f833c41e77c4475ef84bbc043393c682ed35662cb2629f110b6456f97
MD5 419b5371c5b03313d1c8c50569243a11
SHA1 fc7709203c8b7301f52119692b9030bd9111a9f3
SHA512 877b5de7c8191dc729a8a306e2f06bcfa655ac6eced860ab62bd5278b6b87a25e5e6422a9f91c2c4dae1ef022891175397e0a5adb7c7cad9304fef1dc2ccddb6
SSDEEP 6144:/sIZ6nW8QCBTyPRqyhYPbncTBlhHr+ndnkv0oXo:URW82Jq8YPbncT3ZC
TLSH
T12A479E83EB8148FAC8DD167850BAA77A3A3B9A500B181FC7B750DFF014E31515A3BD96
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Gh0st RAT payload
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

35:3b:b5:80:08:dc:4d:f8:3e:66:69:18:93:21:bd:7e:67:d7:e5:1d

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Kaspersky Lab,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Technical dept,O=Kaspersky Lab,L=Moscow,ST=Moscow,C=RU

Chains

Oct 20, 2009

CN=Kaspersky Lab,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Technical dept,O=Kaspersky Lab,L=Moscow,ST=Moscow,C=RU

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Kaspersky Lab,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Technical dept,O=Kaspersky Lab,L=Moscow,ST=Moscow,C=RU

Serial Number

73:88:d3:75:b5:e7:44:4f:67:f4:4a:dd:0e:65:10:98

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 18, 2009 - Mar 13, 2010

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Minor OS version

Major OS version

Entry point

11334

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

2026-05-18_419b5371c5b03313d1c8c50569243a11_elex_gh0st-rat_wannacry

PE Signature issue

generic