gh0strat | 2026-08-04_96d5329d20231e39e8bf90ee61663aaf_elex_gh0st-rat_wannacry

Sharing

Copy URL Twitter E-mail

General

Target
2026-08-04_96d5329d20231e39e8bf90ee61663aaf_elex_gh0st-rat_wannacry
Size 3.5MB
Sample260804-r88deashle
SHA256 18e69045f50203a47b70f479f67c5f3219b34bbb4217547a0eb2036f81e58858
MD5 96d5329d20231e39e8bf90ee61663aaf
SHA1 6e59eb44dfd26f606ffc7d05c76a2831724912a0
SHA512 dd2de82890b4f06ed399c4dd196eeeef2d54c724357cd787bcc9c6160d82ab35e2fe52c2664e26df735db50b622071cb28779f9a7962da1f2f431b99adfb51f9
SSDEEP 24576:UQKQVQQxfnr+TK7r79/JD71PRi4M5NCRkE4+k:yAo
TLSH
T17606DB82427F0356DDCD22659F70086ED9F8ADD290D2BC2CAF916ECEC539B81B548736
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat gh0strat

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-04_96d5329d20231e39e8bf90ee61663aaf_elex_gh0st-rat_wannacry

File Explorer

2026-08-04_96d5329d20231e39e8bf90ee61663aaf_elex_gh0st-rat_wannacry

.exe 3.5MB

2026-08-04_96d5329d20231e39e8bf90ee61663aaf_elex_gh0st-rat_wannacry

IMPHASH 4f7a8aad56de9da5ad5543231a9c2656
SHA256 18e69045f50203a47b70f479f67c5f3219b34bbb4217547a0eb2036f81e58858
MD5 96d5329d20231e39e8bf90ee61663aaf
SHA1 6e59eb44dfd26f606ffc7d05c76a2831724912a0
SHA512 dd2de82890b4f06ed399c4dd196eeeef2d54c724357cd787bcc9c6160d82ab35e2fe52c2664e26df735db50b622071cb28779f9a7962da1f2f431b99adfb51f9
SSDEEP 24576:UQKQVQQxfnr+TK7r79/JD71PRi4M5NCRkE4+k:yAo
TLSH
T17606DB82427F0356DDCD22659F70086ED9F8ADD290D2BC2CAF916ECEC539B81B548736
MD5 SHA1 SHA512 SSDEEP TLSH

windows:45749 windows x86 arch:x86

Gh0st RAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

29828

Major OS version

45749

Entry point

419652

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrcatA FreeLibrary GetPrivateProfileStringA DeleteFileA CreateDirectoryA GetFileAttributesA GetVolumeInformationA FindClose LocalFree FindFirstFileA LocalAlloc MoveFileA GetVersion DeviceIoControl Sleep MultiByteToWideChar GlobalFree GlobalUnlock GlobalLock GlobalAlloc GetModuleFileNameA CopyFileA CloseHandle WriteFile SetFilePointer GetStartupInfoA OpenProcess GetProcAddress LoadLibraryA LeaveCriticalSection WideCharToMultiByte lstrcpyA InterlockedExchange lstrlenA GetModuleHandleA GetLastError RaiseException GetPrivateProfileSectionNamesA

user32

CreateWindowExA PostMessageA GetUserObjectInformationA OpenInputDesktop SetThreadDesktop CloseDesktop EnumWindows IsWindowVisible LoadIconA RegisterClassExA UpdateWindow DefWindowProcA GetCursorPos GetCursorInfo ReleaseDC GetDesktopWindow GetDC GetMessageA GetSystemMetrics GetClipboardData OpenClipboard EmptyClipboard SetClipboardData CloseClipboard mouse_event SetCursorPos WindowFromPoint SetCapture MapVirtualKeyA SystemParametersInfoA DestroyCursor LoadCursorA GetKeyState GetAsyncKeyState GetForegroundWindow GetWindowTextA ExitWindowsEx MessageBoxA CharNextA EndDialog CreateDialogParamA ShowWindow TranslateMessage SetRect SetWindowPos GetDlgItemTextA CloseWindow SetDlgItemTextA GetDlgItem SendMessageA GetClientRect DispatchMessageA

gdi32

CreateCompatibleBitmap GetDIBits BitBlt DeleteDC DeleteObject CreateDIBSection SelectObject

shell32

SHGetSpecialFolderPathA

ole32

CoTaskMemFree CoUninitialize CoInitialize CoCreateInstance

oleaut32

SysFreeString

msvcrt

_controlfp __set_app_type __p__fmode _strnicmp _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln _XcptFilter _exit _onexit __dllonexit calloc vsprintf _beginthreadex sprintf strncat wcscpy _errno strncpy strncmp atoi exit strrchr _except_handler3 free malloc strchr _purecall strstr _ftol ceil memmove __CxxFrameHandler ??3@YAXPAX@Z _strcmpi ??0exception@@QAE@ABV0@@Z strlen _CxxThrowException ??1exception@@UAE@XZ ??0exception@@QAE@ABQBD@Z memcpy __p__commode ??2@YAPAXI@Z ??1type_info@@UAE@XZ

winmm

waveInPrepareHeader waveInOpen waveInGetNumDevs waveOutPrepareHeader waveOutOpen waveOutGetNumDevs waveInStart waveOutWrite waveInStop waveInReset waveInClose waveOutReset waveOutUnprepareHeader waveOutClose waveInAddBuffer waveInUnprepareHeader

ws2_32

closesocket select send inet_ntoa inet_addr getsockname bind getpeername accept listen sendto recvfrom __WSAFDIsSet gethostname ntohs socket gethostbyname WSAStartup WSACleanup htons connect setsockopt WSAIoctl recv

netapi32

NetLocalGroupAddMembers NetUserAdd

wtsapi32

WTSFreeMemory