gh0strat | 2026-08-17_0c6f80fc79488fb10048ad8e1c6ae662_elex_gh0st-rat_wannacry

General

Target
2026-08-17_0c6f80fc79488fb10048ad8e1c6ae662_elex_gh0st-rat_wannacry
Size 24.9MB
Sample260817-eamb3asgjc
SHA256 b35b2ec47fa825bd9ca585e48080de1f9f3e7948d96935f0963c7e1ff228a113
MD5 0c6f80fc79488fb10048ad8e1c6ae662
SHA1 ac27b309d707ed4d159c8449a2804d39df4ad1ac
SHA512 f6b3e7f05c10e2cf855b5528ab6addad844b9543dd39a620a20e548b8b49b1d065dc76a0f2471150c5b8d630c960894268ecedcaa25dcd63513cac3210ce5ff5
SSDEEP 6144:QcIc6nW8QqYB5yPNFyfYPbXcTBlhHrCndnkPd0:VqW8/rVFaYPbXcT3RW
TLSH
T16F479E43EB8148FAC8DD167850BAA77A363B9A500B181FC3BB54EFF014E70515A3BD96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat gh0strat

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-08-17_0c6f80fc79488fb10048ad8e1c6ae662_elex_gh0st-rat_wannacry

2026-08-17_0c6f80fc79488fb10048ad8e1c6ae662_elex_gh0st-rat_wannacry

.exe 24.9MB

SHA256 b35b2ec47fa825bd9ca585e48080de1f9f3e7948d96935f0963c7e1ff228a113
MD5 0c6f80fc79488fb10048ad8e1c6ae662
SHA1 ac27b309d707ed4d159c8449a2804d39df4ad1ac
SHA512 f6b3e7f05c10e2cf855b5528ab6addad844b9543dd39a620a20e548b8b49b1d065dc76a0f2471150c5b8d630c960894268ecedcaa25dcd63513cac3210ce5ff5
SSDEEP 6144:QcIc6nW8QqYB5yPNFyfYPbXcTBlhHrCndnkPd0:VqW8/rVFaYPbXcT3RW
TLSH
T16F479E43EB8148FAC8DD167850BAA77A363B9A500B181FC3BB54EFF014E70515A3BD96
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

0

Entry point

11334

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths