gh0strat | 2026-11-01_bf3b517d378ba44ecdc0aae519e7bb31_elex_parite_wannacry

General

Target
2026-11-01_bf3b517d378ba44ecdc0aae519e7bb31_elex_parite_wannacry
Size 2.2MB
Sample261102-ly332svs5q
SHA256 837e4150137be7ae5901c90956c184314b4c941c9196cd487afad33f6a826fc8
MD5 bf3b517d378ba44ecdc0aae519e7bb31
SHA1 f7e7c6deb744703473c745b12859e3db30e2b3af
SHA512 001882eb8045f5135ca0009a20ff88a4a847a405e49ee868765daf1d0713ed5be931c2a56dcc189dc96ab4d06d879b5d3695d16bab1a1dfaef5c99a55c509166
SSDEEP 24576:ouLwoR5RNPjKoOIuLwoR5RNPjKoO+uLwoR5RNPjKoOTuLwoR5RNPjKoOduLwoR54:RPjOxPjOrPjOQPjOWPjOJPjOfPG
TLSH
T163B5DF01BEE740F9EAE8003C20FB2776963B6898FB085FD36319EE755837555E632246
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat gh0strat

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-01_bf3b517d378ba44ecdc0aae519e7bb31_elex_parite_wannacry

SHA256 837e4150137be7ae5901c90956c184314b4c941c9196cd487afad33f6a826fc8
MD5 bf3b517d378ba44ecdc0aae519e7bb31
SHA1 f7e7c6deb744703473c745b12859e3db30e2b3af
SHA512 001882eb8045f5135ca0009a20ff88a4a847a405e49ee868765daf1d0713ed5be931c2a56dcc189dc96ab4d06d879b5d3695d16bab1a1dfaef5c99a55c509166
SSDEEP 24576:ouLwoR5RNPjKoOIuLwoR5RNPjKoO+uLwoR5RNPjKoOTuLwoR5RNPjKoOduLwoR54:RPjOxPjOrPjOQPjOWPjOJPjOfPG
TLSH
T163B5DF01BEE740F9EAE8003C20FB2776963B6898FB085FD36319EE755837555E632246
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

188416

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths