gh0strat | 2026-08-08_5e82017282d8f2bdf57e7f6a5c506e44_elex_parite_wannacry

General

Target
2026-08-08_5e82017282d8f2bdf57e7f6a5c506e44_elex_parite_wannacry
Size 348KB
Sample260808-fm56datycw
SHA256 f0c12da40cbdc974f5cfa1b1902ff314e384730507768f2256ef71088b463d66
MD5 5e82017282d8f2bdf57e7f6a5c506e44
SHA1 b778fe7089cc8d31dca40fe88cfab9e0ca15e53d
SHA512 81fff036b5f5d216cace57884a5fd4d6349e494f8e36f8fa3c59d7c993c7db0401981daf2dd6bb448492362258b9cd9b87280366075481dbe02804b03e858359
SSDEEP 6144:MJueTkwOwoWOQ3dwaWB28edeP/deUv80P80Ap8UGwoTGHZOWJkqd0K4rG7eVT0S6:ouLwoZQGpnedeP/deUe1ppGjTGHZRT0m
TLSH
T16574DF01BEE640F9EAF8003C20FB2776963B6898FB085FD36319EA751837555E632256
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat gh0strat

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-08_5e82017282d8f2bdf57e7f6a5c506e44_elex_parite_wannacry

SHA256 f0c12da40cbdc974f5cfa1b1902ff314e384730507768f2256ef71088b463d66
MD5 5e82017282d8f2bdf57e7f6a5c506e44
SHA1 b778fe7089cc8d31dca40fe88cfab9e0ca15e53d
SHA512 81fff036b5f5d216cace57884a5fd4d6349e494f8e36f8fa3c59d7c993c7db0401981daf2dd6bb448492362258b9cd9b87280366075481dbe02804b03e858359
SSDEEP 6144:MJueTkwOwoWOQ3dwaWB28edeP/deUv80P80Ap8UGwoTGHZOWJkqd0K4rG7eVT0S6:ouLwoZQGpnedeP/deUe1ppGjTGHZRT0m
TLSH
T16574DF01BEE640F9EAF8003C20FB2776963B6898FB085FD36319EA751837555E632256
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

188416

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths