gh0strat | 2026-09-25_dfac14f1b2da0df6f29ef6cbd018bdf1_elex_gh0st-rat_wannacry

General

Target
2026-09-25_dfac14f1b2da0df6f29ef6cbd018bdf1_elex_gh0st-rat_wannacry
Size 24.9MB
Sample260925-w7cbsstepe
SHA256 f3cf079da2c610ad3932fcdab296c0305515b57c0f87acddf4bdbfdd5122d307
MD5 dfac14f1b2da0df6f29ef6cbd018bdf1
SHA1 14a3c3ee24d4f54faffa5c44d75d8406dae15a50
SHA512 5e49f830839ba886dd32ba9e53332e46a0f2c97220b5b735fdc6497591d72f0b802e3e55203e92a1fb100388308478e7d0b5f15f5acf81af26948e2f60e4e2db
SSDEEP 6144:VcIc6nW8QqYB5yPNFyfYPbXcTBlhHrCndnkPdX:aqW8/rVFaYPbXcT3RV
TLSH
T11F479E43EB8148FAC8DD167850BAA77A363B9A500B181FC3BB54EFF014E70515A3BD96
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat gh0strat

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-09-25_dfac14f1b2da0df6f29ef6cbd018bdf1_elex_gh0st-rat_wannacry

2026-09-25_dfac14f1b2da0df6f29ef6cbd018bdf1_elex_gh0st-rat_wannacry

.exe 24.9MB

SHA256 f3cf079da2c610ad3932fcdab296c0305515b57c0f87acddf4bdbfdd5122d307
MD5 dfac14f1b2da0df6f29ef6cbd018bdf1
SHA1 14a3c3ee24d4f54faffa5c44d75d8406dae15a50
SHA512 5e49f830839ba886dd32ba9e53332e46a0f2c97220b5b735fdc6497591d72f0b802e3e55203e92a1fb100388308478e7d0b5f15f5acf81af26948e2f60e4e2db
SSDEEP 6144:VcIc6nW8QqYB5yPNFyfYPbXcTBlhHrCndnkPdX:aqW8/rVFaYPbXcT3RV
TLSH
T11F479E43EB8148FAC8DD167850BAA77A363B9A500B181FC3BB54EFF014E70515A3BD96
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

0

Entry point

11334

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths