gh0strat | 2026-06-27_b21fbb2fe31e732e86092eb46438e790_elex_gh0st-rat_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-06-27_b21fbb2fe31e732e86092eb46438e790_elex_gh0st-rat_wannacry
Size 24.9MB
Sample260629-ecsa4adx2j
SHA256 6671b975ec6a017d5eb480020c604c74861cfff539ad76af37ba9dff53142dc3
MD5 b21fbb2fe31e732e86092eb46438e790
SHA1 0da168e26e53a2ea25ba08a3029d79138f1f3132
SHA512 05d64ee3c37160b448c45d1c0a4b7bbd966a486c4a476cd36bf72d45784741a6b8f0b80be55e97137bce702e9756f9a72c9c0062944ff210fa1917db1aa512f8
SSDEEP 6144:osIZ6nW8QCBTyPRqyhYPbncTBlhHr+ndnkv0oX4:tRW82Jq8YPbncT3ZK
TLSH
T123479F83EB8148FAC8DD167850BAA77A3A3B9A500B181FC7B750DFF014E31515A3BD96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat gh0strat

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
2026-06-27_b21fbb2fe31e732e86092eb46438e790_elex_gh0st-rat_wannacry

File Explorer

2026-06-27_b21fbb2fe31e732e86092eb46438e790_elex_gh0st-rat_wannacry

.exe 24.9MB

2026-06-27_b21fbb2fe31e732e86092eb46438e790_elex_gh0st-rat_wannacry

SHA256 6671b975ec6a017d5eb480020c604c74861cfff539ad76af37ba9dff53142dc3
MD5 b21fbb2fe31e732e86092eb46438e790
SHA1 0da168e26e53a2ea25ba08a3029d79138f1f3132
SHA512 05d64ee3c37160b448c45d1c0a4b7bbd966a486c4a476cd36bf72d45784741a6b8f0b80be55e97137bce702e9756f9a72c9c0062944ff210fa1917db1aa512f8
SSDEEP 6144:osIZ6nW8QCBTyPRqyhYPbncTBlhHr+ndnkv0oX4:tRW82Jq8YPbncT3ZK
TLSH
T123479F83EB8148FAC8DD167850BAA77A3A3B9A500B181FC7B750DFF014E31515A3BD96
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Gh0st RAT payload
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

44:ff:d3:6f:ee:5d:00:87:56:88:9a:a2:33:56:e7:14:8c:97:06:8f

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Kaspersky Lab,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Technical dept,O=Kaspersky Lab,L=Moscow,ST=Moscow,C=RU

Chains

Oct 20, 2009

CN=Kaspersky Lab,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Technical dept,O=Kaspersky Lab,L=Moscow,ST=Moscow,C=RU

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Kaspersky Lab,OU=Digital ID Class 3 - Microsoft Software Validation v2+OU=Technical dept,O=Kaspersky Lab,L=Moscow,ST=Moscow,C=RU

Serial Number

73:88:d3:75:b5:e7:44:4f:67:f4:4a:dd:0e:65:10:98

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 18, 2009 - Mar 13, 2010

Subject

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Serial Number

61:0c:12:06:00:00:00:00:00:1b

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

May 23, 2006 - May 23, 2016

Minor OS version

Major OS version

Entry point

11334

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing

General

Malware Config

Signatures

File Explorer

2026-06-27_b21fbb2fe31e732e86092eb46438e790_elex_gh0st-rat_wannacry

PE Signature issue

generic