gh0strat | jaffacakes118_Trojan[.]Win32[.]Dialer[.]aroe[.]d121ca8fd89ae9c5861bdc99d1e19eee

General

Target
jaffacakes118_Trojan.Win32.Dialer.aroe.d121ca8fd89ae9c5861bdc99d1e19eee
Size 140KB
Sample261018-yxl5cssv3n
SHA256 256a0537e7fddc529ea823814305e67fc7971e7de7174a54fbe463fae89eaba1
MD5 d121ca8fd89ae9c5861bdc99d1e19eee
SHA1 4313037ec161a13dc639a1a90c961604c219deef
SHA512 fad398e693fabed94cbb60776901d669ff45ac1550b995388498127b48b54ae37885977eb266ddb17f6e1091854367c0ee7e5dc1763d12ca33179d632a0f3690
SSDEEP 3072:WRPMFpnZHhyJ1p8vWLBC1KGY1ugy6ESLpO8SZHeeQHs2YHP:WZwNhyJ1p8CBc5yhpfIHdj
TLSH
T109E38E02BB8441FEF968153034BB3B769639AD9456845ACB771AEEA40C33291FB3534F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat gh0strat

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan.Win32.Dialer.aroe.d121ca8fd89ae9c5861bdc99d1e19eee

jaffacakes118_Trojan.Win32.Dialer.aroe.d121ca8fd89ae9c5861bdc99d1e19eee

.exe 140KB

IMPHASH b281df5e27842eed8dbe079e18f64214
SHA256 256a0537e7fddc529ea823814305e67fc7971e7de7174a54fbe463fae89eaba1
MD5 d121ca8fd89ae9c5861bdc99d1e19eee
SHA1 4313037ec161a13dc639a1a90c961604c219deef
SHA512 fad398e693fabed94cbb60776901d669ff45ac1550b995388498127b48b54ae37885977eb266ddb17f6e1091854367c0ee7e5dc1763d12ca33179d632a0f3690
SSDEEP 3072:WRPMFpnZHhyJ1p8vWLBC1KGY1ugy6ESLpO8SZHeeQHs2YHP:WZwNhyJ1p8CBc5yhpfIHdj
TLSH
T109E38E02BB8441FEF968153034BB3B769639AD9456845ACB771AEEA40C33291FB3534F
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

11855

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths