gh0strat | 2026-11-10_b31174c8802f8ffdc070f1a1ff938f95_elex_parite_wannacry

General

Target
2026-11-10_b31174c8802f8ffdc070f1a1ff938f95_elex_parite_wannacry
Size 1.9MB
Sample261111-2me5vayx2k
SHA256 bf374145bad5ad0cdd12ce1b428da21a7b1513f315186cbb424d20a0c75fb9fb
MD5 b31174c8802f8ffdc070f1a1ff938f95
SHA1 3d2b0699d56c18ed3a7e21da7f2ad25bf453c7c2
SHA512 97a87952efc6aacf08cef3bbcb5bb0f1af2a58ef0e99477c3e96429bc6701b404c14818a41ecd438bf9f140621cca9ec129fb85e48d3425130ad0a1b5ca33336
SSDEEP 24576:ouLwoR5RNPjKoO+uLwoR5RNPjKoOTuLwoR5RNPjKoOduLwoR5RNPjKoOwuLwoR5T:RPjOrPjOQPjOWPjOJPjOfPk
TLSH
T1AA95DF01BEE740F9EAE8003C20FB2776963B6998FB085FD36319EE755833555E632246
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat gh0strat

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-10_b31174c8802f8ffdc070f1a1ff938f95_elex_parite_wannacry

SHA256 bf374145bad5ad0cdd12ce1b428da21a7b1513f315186cbb424d20a0c75fb9fb
MD5 b31174c8802f8ffdc070f1a1ff938f95
SHA1 3d2b0699d56c18ed3a7e21da7f2ad25bf453c7c2
SHA512 97a87952efc6aacf08cef3bbcb5bb0f1af2a58ef0e99477c3e96429bc6701b404c14818a41ecd438bf9f140621cca9ec129fb85e48d3425130ad0a1b5ca33336
SSDEEP 24576:ouLwoR5RNPjKoO+uLwoR5RNPjKoOTuLwoR5RNPjKoOduLwoR5RNPjKoOwuLwoR5T:RPjOrPjOQPjOWPjOJPjOfPk
TLSH
T1AA95DF01BEE740F9EAE8003C20FB2776963B6998FB085FD36319EE755833555E632246
MD5 SHA1 SHA512 SSDEEP TLSH

Minor OS version

0

Major OS version

4

Entry point

188416

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths