gh0strat | 2026-08-14_cd0da630aa8be748410919e479999a26_elex_gh0st-rat_wannacry

General

Target
2026-08-14_cd0da630aa8be748410919e479999a26_elex_gh0st-rat_wannacry
Size 24.9MB
Sample260814-dqmgbstdjf
SHA256 b21d766ca6b8847d36adf50955f6f456e93bb195776614c295f20aab3dc090d9
MD5 cd0da630aa8be748410919e479999a26
SHA1 55f7b2b9d68a50c7cb7ab4dabac78f229bf495d4
SHA512 eeae20d008221ad3cb620e382dfb9943fa22ed2638ceb48688efc673628334265e0562323e0762ff6bc1e3b3eee74d2acbecfeb28650688bf723102d7bdc7205
SSDEEP 6144:7cIc6nW8QqYB5yPNFyfYPbXcTBlhHrCndnkPdH:IqW8/rVFaYPbXcT3RN
TLSH
T11B479E43EB8148FAC8DD167850BAA77A363B9A500B181FC3BB54EFF014E70515A3BD96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat gh0strat

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-14_cd0da630aa8be748410919e479999a26_elex_gh0st-rat_wannacry

2026-08-14_cd0da630aa8be748410919e479999a26_elex_gh0st-rat_wannacry

.exe 24.9MB

SHA256 b21d766ca6b8847d36adf50955f6f456e93bb195776614c295f20aab3dc090d9
MD5 cd0da630aa8be748410919e479999a26
SHA1 55f7b2b9d68a50c7cb7ab4dabac78f229bf495d4
SHA512 eeae20d008221ad3cb620e382dfb9943fa22ed2638ceb48688efc673628334265e0562323e0762ff6bc1e3b3eee74d2acbecfeb28650688bf723102d7bdc7205
SSDEEP 6144:7cIc6nW8QqYB5yPNFyfYPbXcTBlhHrCndnkPdH:IqW8/rVFaYPbXcT3RN
TLSH
T11B479E43EB8148FAC8DD167850BAA77A363B9A500B181FC3BB54EFF014E70515A3BD96
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

0

Entry point

11334

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths