MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 30dec607ab102bfab86c5edfee2f412def56c935b236126316fd3f396abab8fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gh0stRAT


Vendor detections: 14


Intelligence 14 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 30dec607ab102bfab86c5edfee2f412def56c935b236126316fd3f396abab8fa
SHA3-384 hash: 66e535549185a6380d0a2fd50af15f2cdc87d8a1f30e53c1c585f81cf16deb9db4e76c18d39ce35b23eb3816d25b8a7a
SHA1 hash: 1a6dc3a13ec4879de7616edf2406428e073e3e0a
MD5 hash: 50d97d808df1b25790abfdf37c711244
humanhash: finch-wisconsin-pizza-magazine
File name:dfssjjj.exe
Download: download sample
Signature Gh0stRAT
Create hunting rule
File size:2'072'576 bytes
First seen:2024-07-21 14:46:06 UTC
Last seen:2024-07-21 15:22:38 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash c304b6f73e4e55035e9af69223fa8c4a (1 x Gh0stRAT)
ssdeep 24576:8rhWuzlQd4syrrenTVExMtSrXBM8uiYgLO9g4WFKXBK1xxx7Y1r+8Sfu47iGTJB:AFl9sy8TGPDPxxxk1r+hP7iIB
TLSH T1BDA58CF9FC7EE0A7E821907937DA42AF5B6972F490470A0E202DCB14D57309F25A976C
TrID 33.1% (.EXE) InstallShield setup (43053/19/16)
24.0% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
12.7% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
10.0% (.SCR) Windows screen saver (13097/50/3)
8.0% (.EXE) Win64 Executable (generic) (10523/12/4)
File icon (PE):PE icon
dhash icon 71b119dcce576333 (3'570 x Heodo, 203 x TrickBot, 19 x Gh0stRAT)
Reporter Anonymous
Tags:exe Gh0stRAT


Avatar
Anonymous
this malware sample is very nasty!

Intelligence

File Origin
# of uploads :
2
# of downloads :
323
Origin country :
CN CN
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.RATX-gen.16257.9441.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
94.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=669d1f67b302ab76f4482712
Tags:
Execution Generic Infostealer Network Static
Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Creating a file
Modifying an executable file
Running batch commands
Creating a process with a hidden window
Сreating synchronization primitives
Windows shutdown
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
epmicrosoft_visual_cc hook keylogger lolbin microsoft_visual_cc shell32
Link:
https://www.filescan.io/uploads/669d1f69a537d9330be0fe83/reports/57a323bf-c304-464c-af55-9bee4e43e840/overview
Verdict:
Malicious
Labled as:
Malware
Link:
https://www.hybrid-analysis.com/sample/30dec607ab102bfab86c5edfee2f412def56c935b236126316fd3f396abab8fa
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/a5bf0b4c-45a5-438e-981f-e0eda4912d4d
Result
Threat name:
GhostRat, Mimikatz, Nitol
Create hunting rule
Detection:
malicious
Classification:
rans.troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1477558
Signature
AI detected suspicious sample
Contains functionality to detect sleep reduction / modifications
Found API chain indicative of debugger detection
Found evasive API chain (may stop execution after checking mutex)
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample is not signed and drops a device driver
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Writes a notice file (html or txt) to demand a ransom
Yara detected GhostRat
Yara detected Mimikatz
Yara detected Nitol
Behaviour
Behavior Graph:
Download SVG
Score:
94%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/30dec607ab102bfab86c5edfee2f412def56c935b236126316fd3f396abab8fa
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/30dec607ab102bfab86c5edfee2f412def56c935b236126316fd3f396abab8fa/
Threat name:
Win32.Backdoor.Generic
Create hunting rule
Status:
Suspicious
First seen:
2024-07-21 14:47:06 UTC
File Type:
PE (Exe)
Extracted files:
28
AV detection:
8 of 38 (21.05%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gdpmmb5lcav7vodml3p64l2bfxxvnsjvwi3beyyw7u7ts2v2xd5a._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/240721-r5vm5swbrl/
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/e39c8c08-1921-4e89-acc2-4e8d277ab4b9
Unpacked files
SH256 hash:
30dec607ab102bfab86c5edfee2f412def56c935b236126316fd3f396abab8fa
MD5 hash:
50d97d808df1b25790abfdf37c711244
SHA1 hash:
1a6dc3a13ec4879de7616edf2406428e073e3e0a
Link:
https://www.unpac.me/results/e82c12d0-a3c9-4550-a5b1-7d9712907bf9/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/30dec607ab10/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/30dec607ab102bfab86c5edfee2f412def56c935b236126316fd3f396abab8fa

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

Gh0stRAT

Executable exe 30dec607ab102bfab86c5edfee2f412def56c935b236126316fd3f396abab8fa

(this sample)

  
Link
https://bbs.kafan.cn/forum-31-1.html
  
Delivery method
Distributed via e-mail attachment

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CLSIDFromProgID
ole32.dll::CoFreeUnusedLibraries
MULTIMEDIA_APICan Play MultimediaGDI32.dll::StretchDIBits
SHELL_APIManipulates System ShellSHELL32.dll::SHGetFileInfoA
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
WININET.dll::InternetCloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::GetVolumeInformationA
KERNEL32.dll::GetStartupInfoA
KERNEL32.dll::GetDiskFreeSpaceA
KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::SetStdHandle
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileA
KERNEL32.dll::DeleteFileA
ADVAPI32.dll::GetFileSecurityA
KERNEL32.dll::MoveFileA
ADVAPI32.dll::SetFileSecurityA
KERNEL32.dll::GetFileAttributesA
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExA
ADVAPI32.dll::RegCreateKeyA
ADVAPI32.dll::RegDeleteKeyA
ADVAPI32.dll::RegOpenKeyA
ADVAPI32.dll::RegOpenKeyExA
ADVAPI32.dll::RegQueryValueExA
ADVAPI32.dll::RegQueryValueA
WIN_USER_APIPerforms GUI ActionsUSER32.dll::AppendMenuA
USER32.dll::FindWindowA
USER32.dll::PeekMessageA
USER32.dll::CreateWindowExA

Comments