gh0strat | 2026-08-17_dd1c402c3aa8bd1ae25d080227dac82b_elex_gh0st-rat_wannacry

General

Target
2026-08-17_dd1c402c3aa8bd1ae25d080227dac82b_elex_gh0st-rat_wannacry
Size 24.9MB
Sample260817-dwy3basdpc
SHA256 3651fd2927a33a43f932abf1766776c9fc1c4f749ae6886869ac1c7f1f9ab217
MD5 dd1c402c3aa8bd1ae25d080227dac82b
SHA1 bcea833a1ecca28112798c7380ff1efaebc8ed3e
SHA512 d0446c47a0c0c100e40a041d00ff778e755078dc1e37fbc1f97b06c637a270fe3711913de73284b30541c5abe7b8b8141638f3a1c8fa600b4f6e47fc758fc15a
SSDEEP 6144:3cIc6nW8QqYB5yPNFyfYPbXcTBlhHrCndnkPdr:sqW8/rVFaYPbXcT3RF
TLSH
T1E2479E43EB8148FAC8DD167850BAA77A363B9A500B181FC3BB54EFF014E70515A3BD96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat gh0strat

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-17_dd1c402c3aa8bd1ae25d080227dac82b_elex_gh0st-rat_wannacry

2026-08-17_dd1c402c3aa8bd1ae25d080227dac82b_elex_gh0st-rat_wannacry

.exe 24.9MB

SHA256 3651fd2927a33a43f932abf1766776c9fc1c4f749ae6886869ac1c7f1f9ab217
MD5 dd1c402c3aa8bd1ae25d080227dac82b
SHA1 bcea833a1ecca28112798c7380ff1efaebc8ed3e
SHA512 d0446c47a0c0c100e40a041d00ff778e755078dc1e37fbc1f97b06c637a270fe3711913de73284b30541c5abe7b8b8141638f3a1c8fa600b4f6e47fc758fc15a
SSDEEP 6144:3cIc6nW8QqYB5yPNFyfYPbXcTBlhHrCndnkPdr:sqW8/rVFaYPbXcT3RF
TLSH
T1E2479E43EB8148FAC8DD167850BAA77A363B9A500B181FC3BB54EFF014E70515A3BD96
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

0

Entry point

11334

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths