gh0strat | 2026-09-16_306f5486b8ebbe79d7a6d30c1e16c709_elex_gh0st-rat_wannacry

General

Target
2026-09-16_306f5486b8ebbe79d7a6d30c1e16c709_elex_gh0st-rat_wannacry
Size 24.9MB
Sample260916-qrybfavy5l
SHA256 cdd94fa25b8e3bab2459428238fb5ae63c62a6e4923db553d6fea14b1458fce8
MD5 306f5486b8ebbe79d7a6d30c1e16c709
SHA1 721ba835a18410e2043600403f19e798a2c80abc
SHA512 b68cca3f1074b8e6dea494d626fee03c91948c6c44fd6d0faec84c446e55114ab55257c1c008c83a94f18d192962b8cc5327e801f7b461d286c8b33320d58492
SSDEEP 6144:XcIc6nW8QqYB5yPNFyfYPbXcTBlhHrCndnkPdh:MqW8/rVFaYPbXcT3RL
TLSH
T17F479E43EB8148FAC8DD167850BAA77A363B9A500B181FC3BB54EFF014E70515A3BD96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat gh0strat

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-16_306f5486b8ebbe79d7a6d30c1e16c709_elex_gh0st-rat_wannacry

2026-09-16_306f5486b8ebbe79d7a6d30c1e16c709_elex_gh0st-rat_wannacry

.exe 24.9MB

SHA256 cdd94fa25b8e3bab2459428238fb5ae63c62a6e4923db553d6fea14b1458fce8
MD5 306f5486b8ebbe79d7a6d30c1e16c709
SHA1 721ba835a18410e2043600403f19e798a2c80abc
SHA512 b68cca3f1074b8e6dea494d626fee03c91948c6c44fd6d0faec84c446e55114ab55257c1c008c83a94f18d192962b8cc5327e801f7b461d286c8b33320d58492
SSDEEP 6144:XcIc6nW8QqYB5yPNFyfYPbXcTBlhHrCndnkPdh:MqW8/rVFaYPbXcT3RL
TLSH
T17F479E43EB8148FAC8DD167850BAA77A363B9A500B181FC3BB54EFF014E70515A3BD96
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

0

Entry point

11334

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths