MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 01b6902ab0179123e76d72184f38c96d3afc8fcef9aa5206920d228e8e9691a8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gh0stRAT

Vendor detections: 12

Intelligence 12 IOCs YARA 8 File information Comments 1

SHA256 hash:	01b6902ab0179123e76d72184f38c96d3afc8fcef9aa5206920d228e8e9691a8
SHA3-384 hash:	2c78b0a89f661aeea2bd299da61d74ef6dcd8409f4f52509eb3153f69b7e2817fb7cf1446f906364cb22c6ac1eaecabd
SHA1 hash:	77ef70d6ec93cab673ce0ed207874e7cd9bf3fec
MD5 hash:	893b78d1ca183b91cfba1e578340f715
humanhash:	blue-diet-magnesium-batman
File name:	893b78d1ca183b91cfba1e578340f715
Download:	download sample
Signature	Gh0stRAT Create hunting rule
File size:	180'224 bytes
First seen:	2021-11-26 05:10:16 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	07cd32fe06d43febfbbba5706c9ac01e (4 x Gh0stRAT, 2 x Zegost)
ssdeep	3072:otGBk6WFmHlXXYomqOZ2tLJ0L/LhtLRU3XnXdbiGcY:8GBk6WcqoROotLyzlPJGc
Threatray	2 similar samples on MalwareBazaar
TLSH	T13B046B708AC8A232CFA0C2764744D7D3D2EEE65DEB007049459ECB794EBF7996624F60
Reporter	zbetcheckin
Tags:	exe Gh0stRAT

Intelligence

File Origin

# of uploads :

# of downloads :

146

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

893b78d1ca183b91cfba1e578340f715

Verdict:

Suspicious activity

Analysis date:

2021-11-26 05:12:08 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/5ccd15c1-63aa-443a-bc38-14625f1cda86

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Gathering data

Detection(s):

Win.Trojan.Redosdru-9753707-0

Win.Trojan.Genpack-9836703-0

MiscreantPunch.SingleXOR.EXE.219.UNOFFICIAL

Win.Trojan.Agent-174633

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a service

Creating a file in the %temp% directory

Moving a file to the Windows subdirectory

Сreating synchronization primitives

Launching a service

DNS request

Sending a custom TCP request

Enabling autorun for a service

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

backdoor gh0st greyware hupigon obfuscated pcclient zusy zxshell

Link:

https://www.filescan.io/uploads/61a06c67f36138de3f3e1fe5/reports/23b999c1-1dac-4afb-a110-bc122b84ab37/overview

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Gh0st RAT

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/3739c5dd-3baa-4b88-9a53-44c17fb8e703

Result

Threat name:

GhostRat

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/896483

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Contains functionality to detect sleep reduction / modifications

Creates a Windows Service pointing to an executable in C:\Windows

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected GhostRat

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/01b6902ab0179123e76d72184f38c96d3afc8fcef9aa5206920d228e8e9691a8/

Threat name:

Win32.Trojan.SchoolBoy

Status:

Malicious

First seen:

2021-11-25 06:16:23 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

27 of 28 (96.43%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ag3jakvqc6ishz3noime6ogjnu5pzd6o7gvfebusburi5duwsgua._file

Verdict:

malicious

Gh0stRAT

e046697b4102be8e3ad4b6e04524e7248d86b58f6d9f4884357fd33768878fbd

Gh0stRAT

Result

Malware family:

n/a

Score:

10/10

Tags:

bootkit persistence suricata

Link:

https://tria.ge/reports/211126-ft93xaaegp/

Behaviour

Checks processor information in registry

Modifies data under HKEY_USERS

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Drops file in System32 directory

Writes to the Master Boot Record (MBR)

Deletes itself

Loads dropped DLL

Sets DLL path for service in the registry

suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic

suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 102

Unpacked files

SH256 hash:

231c2d2067a5beb91fef322821cacdc96e19ecdd49100ca6bbb574b4245b8aa2

MD5 hash:

8c6804ec7d6bdba27957a15335b33e94

SHA1 hash:

3e095b6b01a803e44dae25a9aed867556ac95019

Link:

https://www.unpac.me/results/6d279cc9-0a72-47b2-838e-fe34b05affcf/

SH256 hash:

01b6902ab0179123e76d72184f38c96d3afc8fcef9aa5206920d228e8e9691a8

MD5 hash:

893b78d1ca183b91cfba1e578340f715

SHA1 hash:

77ef70d6ec93cab673ce0ed207874e7cd9bf3fec

Link:

https://www.unpac.me/results/6d279cc9-0a72-47b2-838e-fe34b05affcf/

Malware family:

ZxShell

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/01b6902ab017/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Backdoor

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/01b6902ab0179123e76d72184f38c96d3afc8fcef9aa5206920d228e8e9691a8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Backdoor_Redosdru_Jun17 Create hunting rule
Author:	Florian Roth
Description:	Detects malware Redosdru - file systemHome.exe
Reference:	https://goo.gl/OOB3mH

Rule name:	Backdoor_Redosdru_Jun17_RID2FD1 Create hunting rule
Author:	Florian Roth
Description:	Detects malware Redosdru - file systemHome.exe
Reference:	https://goo.gl/OOB3mH

Rule name:	SUSP_XORed_MSDOS_Stub_Message Create hunting rule
Author:	Florian Roth
Description:	Detects suspicious XORed MSDOS stub message
Reference:	https://yara.readthedocs.io/en/latest/writingrules.html#xor-strings

Rule name:	SUSP_XORed_URL_in_EXE Create hunting rule
Author:	Florian Roth
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	SUSP_XORed_URL_in_EXE_RID2E46 Create hunting rule
Author:	Florian Roth
Description:	Detects an XORed URL in an executable
Reference:	https://twitter.com/stvemillertime/status/1237035794973560834

Rule name:	XOREngine_Misc_XOR_Func Create hunting rule
Author:	smiller cc @florian @wesley idea on implementation with yara's built in XOR function
Description:	Use with care, https://twitter.com/cyb3rops/status/1237042104406355968

Rule name:	ZxShell_Related_Malware_CN_Group_Jul17_3 Create hunting rule
Author:	Florian Roth
Description:	Detects a ZxShell related sample from a CN threat group
Reference:	https://blogs.rsa.com/cat-phishing/

Rule name:	ZxShell_Related_Malware_CN_Group_Jul17_3_RID3603 Create hunting rule
Author:	Florian Roth
Description:	Detects a ZxShell related sample from a CN threat group
Reference:	https://blogs.rsa.com/cat-phishing/