gh0strat | 2026-07-21_a400250aab0d1c33e4a51a7b61bf8cc0_elex_gh0st-rat_wannacry

General

Target
2026-07-21_a400250aab0d1c33e4a51a7b61bf8cc0_elex_gh0st-rat_wannacry
Size 24.9MB
Sample260721-ejapmafw9x
SHA256 f351db5ee4f6bd645b90d97fdc49306f3fc56440467ca1f1ba0b6173a14de578
MD5 a400250aab0d1c33e4a51a7b61bf8cc0
SHA1 fd5efcee8d965712c636753b9cc263ccbeb4e6e5
SHA512 23a7beaecaca789187b2708de994987ccc422ec56828cacd603f0c61ac291d92ee1d825268a97100d2efe4a5077667b157f6ae166f259f20254320cf1aea2664
SSDEEP 6144:+cIc6nW8QqYB5yPNFyfYPbXcTBlhHrCndnkPdZ:jqW8/rVFaYPbXcT3Rz
TLSH
T1C0479E43EB8148FAC8DD167850BAA77A363B9A500B181FC3BB54EFF014E70515A3BD96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat gh0strat

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-21_a400250aab0d1c33e4a51a7b61bf8cc0_elex_gh0st-rat_wannacry

2026-07-21_a400250aab0d1c33e4a51a7b61bf8cc0_elex_gh0st-rat_wannacry

.exe 24.9MB

SHA256 f351db5ee4f6bd645b90d97fdc49306f3fc56440467ca1f1ba0b6173a14de578
MD5 a400250aab0d1c33e4a51a7b61bf8cc0
SHA1 fd5efcee8d965712c636753b9cc263ccbeb4e6e5
SHA512 23a7beaecaca789187b2708de994987ccc422ec56828cacd603f0c61ac291d92ee1d825268a97100d2efe4a5077667b157f6ae166f259f20254320cf1aea2664
SSDEEP 6144:+cIc6nW8QqYB5yPNFyfYPbXcTBlhHrCndnkPdZ:jqW8/rVFaYPbXcT3Rz
TLSH
T1C0479E43EB8148FAC8DD167850BAA77A363B9A500B181FC3BB54EFF014E70515A3BD96
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

0

Entry point

11334

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths