gh0strat | jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]4633bc36120fad2c2d768d64eb5eec83

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.4633bc36120fad2c2d768d64eb5eec83
Size 656KB
Sample261011-zzv1qaxtbs
SHA256 e1f6490e1f3a22b2061739a7efb6d572671c4d12ccf4c4c54429ab44a63e6b1b
MD5 4633bc36120fad2c2d768d64eb5eec83
SHA1 042515e09e8153ad9d6ee1697b1e68991b5fc029
SHA512 9fdc49743b1775e4852f6b9a918bd9bc0d6d04d3b96640b4e997d97397b7fb39e7c22d48172cfe16ba18799393dd9583d86e68c23b263f535e93de4449d5fdbd
SSDEEP 6144:66cPpODxCdS7eOUQ41siTtiWB0mL7tZJ5Vp34OM5y4G7WH3jVonGIMLgzRfVJo70:6VcCzXB0mdZrVNt9moKMzRtJY4bfFF5F
TLSH
T18DE4F122B98DC5F2ED54043008E76FB65A39BD8B07016E8797CDFF2E6D32292D71611A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat gh0strat

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.4633bc36120fad2c2d768d64eb5eec83

jaffacakes118_HEUR.Trojan.Win32.Generic.4633bc36120fad2c2d768d64eb5eec83

.exe 656KB

SHA256 e1f6490e1f3a22b2061739a7efb6d572671c4d12ccf4c4c54429ab44a63e6b1b
MD5 4633bc36120fad2c2d768d64eb5eec83
SHA1 042515e09e8153ad9d6ee1697b1e68991b5fc029
SHA512 9fdc49743b1775e4852f6b9a918bd9bc0d6d04d3b96640b4e997d97397b7fb39e7c22d48172cfe16ba18799393dd9583d86e68c23b263f535e93de4449d5fdbd
SSDEEP 6144:66cPpODxCdS7eOUQ41siTtiWB0mL7tZJ5Vp34OM5y4G7WH3jVonGIMLgzRfVJo70:6VcCzXB0mdZrVNt9moKMzRtJY4bfFF5F
TLSH
T18DE4F122B98DC5F2ED54043008E76FB65A39BD8B07016E8797CDFF2E6D32292D71611A
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

301788

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths