gh0strat | 2026-08-15_f0d0eeb40997eea33f66c856a31f0c5f_elex_gh0st-rat_wannacry

General

Target
2026-08-15_f0d0eeb40997eea33f66c856a31f0c5f_elex_gh0st-rat_wannacry
Size 24.9MB
Sample260815-3rekjsac49
SHA256 71be634da646bbbffd98243830793e69e88924c8ed7ac4509bc77d9ab377e634
MD5 f0d0eeb40997eea33f66c856a31f0c5f
SHA1 c139d5611c4f9ad266afca4dcba4bd0b07de757d
SHA512 de43d7317e811d89222342eb568b82472a564a34c3ae4b7f029c73a2a5b4c7681adab5e36bf8d44dc77bb58e509c5c82aef02616768af7445e424e54e4efe597
SSDEEP 6144:vcIc6nW8QqYB5yPNFyfYPbXcTBlhHrCndnkPdL:0qW8/rVFaYPbXcT3R1
TLSH
T18E479E43EB8148FAC8DD167850BAA77A363B9A500B181FC3BB54EFF014E70515A3BD96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat gh0strat

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-15_f0d0eeb40997eea33f66c856a31f0c5f_elex_gh0st-rat_wannacry

2026-08-15_f0d0eeb40997eea33f66c856a31f0c5f_elex_gh0st-rat_wannacry

.exe 24.9MB

SHA256 71be634da646bbbffd98243830793e69e88924c8ed7ac4509bc77d9ab377e634
MD5 f0d0eeb40997eea33f66c856a31f0c5f
SHA1 c139d5611c4f9ad266afca4dcba4bd0b07de757d
SHA512 de43d7317e811d89222342eb568b82472a564a34c3ae4b7f029c73a2a5b4c7681adab5e36bf8d44dc77bb58e509c5c82aef02616768af7445e424e54e4efe597
SSDEEP 6144:vcIc6nW8QqYB5yPNFyfYPbXcTBlhHrCndnkPdL:0qW8/rVFaYPbXcT3R1
TLSH
T18E479E43EB8148FAC8DD167850BAA77A363B9A500B181FC3BB54EFF014E70515A3BD96
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

0

Entry point

11334

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths