gh0strat | 2026-07-08_8b7ec6c027266b810bd467ddc688696b_elex_gh0st-rat_wannacry

General

Target
2026-07-08_8b7ec6c027266b810bd467ddc688696b_elex_gh0st-rat_wannacry
Size 24.9MB
Sample260708-176mvsax91
SHA256 c54ec137764b8b8310bd4434c99665a4173796416b04b3fe646962f6f9a7768f
MD5 8b7ec6c027266b810bd467ddc688696b
SHA1 75c9c10489006d15943f9191bd174383a6ded204
SHA512 06712517f7d52817407a578ec4acea5dacec8f778f5a5764fb9f652220ac94d4285f547030a19abbfa86107b2a7b9f439ccb9708c446c15e6664c93db7389cb3
SSDEEP 6144:ucIc6nW8QqYB5yPNFyfYPbXcTBlhHrCndnkPdB:TqW8/rVFaYPbXcT3Rr
TLSH
T105479E43EB8148FAC8DD167850BAA77A363B9A500B181FC3BB54EFF014E70515A3BD96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat gh0strat

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-08_8b7ec6c027266b810bd467ddc688696b_elex_gh0st-rat_wannacry

2026-07-08_8b7ec6c027266b810bd467ddc688696b_elex_gh0st-rat_wannacry

.exe 24.9MB

SHA256 c54ec137764b8b8310bd4434c99665a4173796416b04b3fe646962f6f9a7768f
MD5 8b7ec6c027266b810bd467ddc688696b
SHA1 75c9c10489006d15943f9191bd174383a6ded204
SHA512 06712517f7d52817407a578ec4acea5dacec8f778f5a5764fb9f652220ac94d4285f547030a19abbfa86107b2a7b9f439ccb9708c446c15e6664c93db7389cb3
SSDEEP 6144:ucIc6nW8QqYB5yPNFyfYPbXcTBlhHrCndnkPdB:TqW8/rVFaYPbXcT3Rr
TLSH
T105479E43EB8148FAC8DD167850BAA77A363B9A500B181FC3BB54EFF014E70515A3BD96
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

0

Entry point

11334

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths