gh0strat | 2026-07-22_219c98b7ef3cfd203ee5eacda1cf3cee_elex_gh0st-rat_wannacry

General

Target
2026-07-22_219c98b7ef3cfd203ee5eacda1cf3cee_elex_gh0st-rat_wannacry
Size 24.9MB
Sample260723-cd4dmsfb68
SHA256 d16734d6887e040fc7e405da98308bac38f297ef56cb3d0b2f7521574d3c2c83
MD5 219c98b7ef3cfd203ee5eacda1cf3cee
SHA1 ed027c8266a751406d813ff94f58d81aeb6e87a2
SHA512 273bfdb385e9194679732dbe8eda6c6a8bee7ed110bf049bd93134ccd0e40737b9f0bd130374dd2a2900e47074271137d96fd0a2b151ffedaa24f678c631b7eb
SSDEEP 6144:HcIc6nW8QqYB5yPNFyfYPbXcTBlhHrCndnkPdr:8qW8/rVFaYPbXcT3Rh
TLSH
T141479E43EB8148FAC8DD167850BAA77A363B9A500B181FC3BB54EFF014E70515A3BD96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat gh0strat

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-22_219c98b7ef3cfd203ee5eacda1cf3cee_elex_gh0st-rat_wannacry

2026-07-22_219c98b7ef3cfd203ee5eacda1cf3cee_elex_gh0st-rat_wannacry

.exe 24.9MB

SHA256 d16734d6887e040fc7e405da98308bac38f297ef56cb3d0b2f7521574d3c2c83
MD5 219c98b7ef3cfd203ee5eacda1cf3cee
SHA1 ed027c8266a751406d813ff94f58d81aeb6e87a2
SHA512 273bfdb385e9194679732dbe8eda6c6a8bee7ed110bf049bd93134ccd0e40737b9f0bd130374dd2a2900e47074271137d96fd0a2b151ffedaa24f678c631b7eb
SSDEEP 6144:HcIc6nW8QqYB5yPNFyfYPbXcTBlhHrCndnkPdr:8qW8/rVFaYPbXcT3Rh
TLSH
T141479E43EB8148FAC8DD167850BAA77A363B9A500B181FC3BB54EFF014E70515A3BD96
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

0

Entry point

11334

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths