gh0strat | jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]fc5b78546e613b51e6491ea7e440106e

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.fc5b78546e613b51e6491ea7e440106e
Size 106KB
Sample261019-a9bmdscw2y
SHA256 1a2d617d539dcbe01984a1719c5be97ef7c1643a1e5a182c12b24785e27c1cf0
MD5 fc5b78546e613b51e6491ea7e440106e
SHA1 3d5e08263a2f4d2ddcfa97bfaa928df906970c3d
SHA512 155d46ffabea717e61b085c6655fdc973ec64c6ced879d267029e83092589d7c3143408abe2463c0d9d6b5c566476a5421d54971233f69d9123e4644b61b5397
SSDEEP 3072:OHvzJT1/QKNpvgPC4WaHCeOi4W9rD5zarZB/:mvzBqCvyOi4WvzaX/
TLSH
T172B38E42F54540FFD6A8157C28FA7777EB3B79B69F18EE837314EE150472090A72228A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat gh0strat

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.fc5b78546e613b51e6491ea7e440106e

jaffacakes118_HEUR.Trojan.Win32.Generic.fc5b78546e613b51e6491ea7e440106e

.dll 106KB

SHA256 1a2d617d539dcbe01984a1719c5be97ef7c1643a1e5a182c12b24785e27c1cf0
MD5 fc5b78546e613b51e6491ea7e440106e
SHA1 3d5e08263a2f4d2ddcfa97bfaa928df906970c3d
SHA512 155d46ffabea717e61b085c6655fdc973ec64c6ced879d267029e83092589d7c3143408abe2463c0d9d6b5c566476a5421d54971233f69d9123e4644b61b5397
SSDEEP 3072:OHvzJT1/QKNpvgPC4WaHCeOi4W9rD5zarZB/:mvzBqCvyOi4WvzaX/
TLSH
T172B38E42F54540FFD6A8157C28FA7777EB3B79B69F18EE837314EE150472090A72228A
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

0

Entry point

75647

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths