MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 05fd4196d72d1f6b4d01852420fa5b8381b15e9d7a82cdf218962f8d626910d8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Gh0stRAT
Vendor detections: 12
| SHA256 hash: | 05fd4196d72d1f6b4d01852420fa5b8381b15e9d7a82cdf218962f8d626910d8 |
|---|---|
| SHA3-384 hash: | 1bb11380a39d56194c76febfca693ff6547041a5f21040c0d3bdad7bf3222101cdfd45d34832ce80a560cbd5debb65fd |
| SHA1 hash: | 60113887964c0195f33bcea9c77651dd78bf3507 |
| MD5 hash: | 395c835be7231c15e0be31eb0b6c6747 |
| humanhash: | october-violet-don-violet |
| File name: | 05FD4196D72D1F6B4D01852420FA5B8381B15E9D7A82C.exe |
| Download: | download sample |
| Signature | Gh0stRAT |
| File size: | 196'608 bytes |
| First seen: | 2022-04-14 23:36:25 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | d4a8f890d5c5efaafc161f6774cfdb16 (1 x Gh0stRAT) |
| ssdeep | 3072:eizm/NB8nWHni1cy98KeWdCS0BNvvTmrHCIdcmedah/Ore0/8+xh4/C3DWRvX6ZD:eizmwnWHnfy9teWdd0B9zmzKahqe0/8O |
| Threatray | 7 similar samples on MalwareBazaar |
| TLSH | T16E146B28DA9C9C73F24770F4B41643DE254AEAC182547292BEE5B4FF25BCD0662723B1 |
| TrID | 61.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 16.6% (.EXE) Win32 Executable (generic) (4505/5/1) 7.4% (.EXE) OS/2 Executable (generic) (2029/13) 7.3% (.EXE) Generic Win/DOS Executable (2002/3) 7.3% (.EXE) DOS Executable Generic (2000/1) |
| File icon (PE): |  |
| dhash icon | e4f4c6d6e6e6ccdc (1 x Gh0stRAT) |
| Reporter |  abuse_ch |
| Tags: | exe Gh0stRAT |
Indicators Of Compromise (IOCs)
Below is a list of indicators of compromise (IOCs) associated with this malware samples.
| IOC | ThreatFox Reference |
|---|---|
| 183.236.2.18:61 | https://threatfox.abuse.ch/ioc/519976/ |
Intelligence
File Origin
# of uploads :
1
# of downloads :
338
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
05FD4196D72D1F6B4D01852420FA5B8381B15E9D7A82C.exe
Verdict:
Suspicious activity
Analysis date:
2022-04-14 23:37:44 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file
Creating a process from a recently created file
Creating a service
Creating a file in the %temp% directory
Moving a file to the Program Files subdirectory
Сreating synchronization primitives
Launching a service
Launching a process
Creating a file in the Windows subdirectories
DNS request
Sending a custom TCP request
Enabling autorun for a service
Result
Malware family:
n/a
Score:
5/10
Tags:
n/a
Behaviour
MalwareBazaar
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
obfuscated pcclient
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Verdict:
Malicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
92 / 100
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Deletes itself after installation
Drops PE files to the user root directory
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Sigma detected: Execution of Suspicious File Type Extension
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Fugrafa
Status:
Malicious
First seen:
2013-01-07 17:30:00 UTC
File Type:
PE (Exe)
Extracted files:
3
AV detection:
30 of 42 (71.43%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
Result
Malware family:
n/a
Score:
10/10
Tags:
bootkit persistence suricata
Behaviour
Checks processor information in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Drops file in System32 directory
Writes to the Master Boot Record (MBR)
Deletes itself
Loads dropped DLL
Executes dropped EXE
suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic
suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 102
Unpacked files
SH256 hash:
26781449dff55f05073a0432e312092a6fea992c474676350c4877d5557198d2
MD5 hash:
5f6f0ef4408d45694d482f3b71a40ec1
SHA1 hash:
282a906aae4c98186d26e25616ce10944cd03b78
SH256 hash:
05fd4196d72d1f6b4d01852420fa5b8381b15e9d7a82cdf218962f8d626910d8
MD5 hash:
395c835be7231c15e0be31eb0b6c6747
SHA1 hash:
60113887964c0195f33bcea9c77651dd78bf3507
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.55
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | INDICATOR_EXE_Packed_ASPack |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables packed with ASPack |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.