MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 034e16cc4d4bed9085b7c65e8b23aa445a87fcd81c0874772e8d732224e78896. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gh0stRAT


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 034e16cc4d4bed9085b7c65e8b23aa445a87fcd81c0874772e8d732224e78896
SHA3-384 hash: 810c44583a7f42b7af63b148f00faf990276958c050eaae0f30665a96b1d908134ad4ac417d3053e39cb0be1b41cb284
SHA1 hash: 709e84977d4df301897c20850f722bc68c33ea9c
MD5 hash: c7b25a48cd7d931c5b098718d99e1137
humanhash: vermont-vermont-video-dakota
File name:034e16cc4d4bed9085b7c65e8b23aa445a87fcd81c0874772e8d732224e78896
Download: download sample
Signature Gh0stRAT
Create hunting rule
File size:15'958'336 bytes
First seen:2022-06-06 12:39:33 UTC
Last seen:2022-06-06 13:58:09 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 1e92fd54d65284238a0e3b74b2715062 (21 x Empyrean, 4 x Gh0stRAT, 4 x Telemiris)
ssdeep 393216:cl4D5PTP1hmJ9c5hlER35ShR4uw22WmfDZHZbBDg1eDQznSKF:m4lL9h+EhkpQ2z7dg8k
Threatray 55 similar samples on MalwareBazaar
TLSH T1DBF63319236224B9FCE2A077C4B32434C272F8421B50D55FA7B523255FE35E86E36FA6
TrID 66.5% (.EXE) InstallShield setup (43053/19/16)
16.2% (.EXE) Win64 Executable (generic) (10523/12/4)
7.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
3.1% (.EXE) OS/2 Executable (generic) (2029/13)
3.0% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon d6928b39990d5d7b (2 x Gh0stRAT)
Reporter JAMESWT_WT
Tags:exe Gh0stRAT kk123456.top signed

Code Signing Certificate

Organisation:VeriSign Class 3 Code Signing 2011-2 CA
Issuer:VeriSign Class 3 Code Signing 2011-2 CA
Algorithm:sha1WithRSAEncryption
Valid from:2011-11-17T04:54:25Z
Valid to:2511-11-17T05:01:08Z
Serial number: 21dc1393c203f2aa403a74496930b78e
Intelligence: 5 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: 4c4a63304e813ca4332cfa5af1ff69ec372b48676ef8a18496e7cac82c399b12
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
2
# of downloads :
341
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
034e16cc4d4bed9085b7c65e8b23aa445a87fcd81c0874772e8d732224e78896
Verdict:
No threats detected
Analysis date:
2022-06-06 18:06:23 UTC
Tags:
installer
Link:
https://app.any.run/tasks/dc5c0cfa-bc02-48c9-9fba-22868a5709ed

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.Agent.Script.1713931.10438.20114.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a file
Sending a custom TCP request
Creating a window
Query of malicious DNS domain
Sending an HTTP GET request to an infection source
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
expand.exe greyware overlay packed
Link:
https://www.filescan.io/uploads/629df5b1bea023f99d87abd7/reports/59096784-1eaa-4be7-93c3-3dd2969b2027/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/fda953d0-383d-4ce2-a680-77aed95bbf09
Result
Threat name:
GhostRat
Create hunting rule
Detection:
malicious
Classification:
troj.spyw
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/1007346
Signature
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected GhostRat
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/034e16cc4d4bed9085b7c65e8b23aa445a87fcd81c0874772e8d732224e78896/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=anhbntcnjpwzbbnxyzpiwi5kirnip7gydqehi5zorvzsejhhrcla._file
Verdict:
suspicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
089b3975338c69d1c8ae96cec13328459e8208c7cf9c88ce98896b90697c140b
Gh0stRAT
314f7cd6f05ec806c204001478d0498bcaed44acb7648f4961faabef6562fe47
Gh0stRAT
3d277a4e25e92651aef2acf0e21f1f84e36909de2b4d3dd27b77539b0332ca57
Gh0stRAT
476a05d5c8ef4444f96cbd02c3a315c56227b7510f75e82249a449bb79e977fc
Gh0stRAT
4b56d8713523dea09695ec6beef98608c234e5f8a9be77be931a687c080fb0f1
Gh0stRAT
684aa3d044556d1883bed06b737a297eac301d14872e1813b0e5cd78cefaa95d
Gh0stRAT
774c3c82a6ba75819070cca4d14f0df9329ebfe5b4dbb2e61423f95281ae7e6d
Gh0stRAT
8d3c6da3f4d6513a1d38058a6cf6028e0c07210a5c0509f47150152362093636
Gh0stRAT
906d1ee4c61e1fa0b1417bbf60d5087ceb1e817a75d314b8471099d0a89e8575
Gh0stRAT
b6bfb18cb265786cbf4373a6dc82d4b8ec586d90f6a6e2cc72a1a3d20b60dda9
Gh0stRAT
+ 45 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
pyinstaller spyware stealer
Link:
https://tria.ge/reports/220606-pv75dacedj/
Behaviour
Suspicious use of WriteProcessMemory
Loads dropped DLL
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
034e16cc4d4bed9085b7c65e8b23aa445a87fcd81c0874772e8d732224e78896
MD5 hash:
c7b25a48cd7d931c5b098718d99e1137
SHA1 hash:
709e84977d4df301897c20850f722bc68c33ea9c
Link:
https://www.unpac.me/results/000c5dae-dd75-49bc-bd51-74c410c30d0d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/034e16cc4d4bed9085b7c65e8b23aa445a87fcd81c0874772e8d732224e78896

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments