MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3d277a4e25e92651aef2acf0e21f1f84e36909de2b4d3dd27b77539b0332ca57. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gh0stRAT


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3d277a4e25e92651aef2acf0e21f1f84e36909de2b4d3dd27b77539b0332ca57
SHA3-384 hash: 3f4f3b018458baee4a4c68cfa8c743d3c6834a0013448b22f116763c3c41d6805b1aa987135307cec5f197c40d4f8f77
SHA1 hash: 6ceefe311e072dc87b618c50dd806abb7b38922c
MD5 hash: fd757131ebee36c55d5415294d598538
humanhash: muppet-iowa-steak-item
File name:joe.exe
Download: download sample
Signature Gh0stRAT
Create hunting rule
File size:15'951'602 bytes
First seen:2022-06-06 09:47:38 UTC
Last seen:2022-06-06 12:38:34 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 1e92fd54d65284238a0e3b74b2715062 (21 x Empyrean, 4 x Gh0stRAT, 4 x Telemiris)
ssdeep 393216:4l4D5PTP1hmJ9c5hlER35ShR4uw22WmfDZHZbBDg1wMlsenSK:K4lL9h+EhkpQ2z7dgQ
Threatray 54 similar samples on MalwareBazaar
TLSH T1A4F63319235224A9ECE2A07784732834C272FC425B50D55FA7F123255FE39F86E3AF96
TrID 66.5% (.EXE) InstallShield setup (43053/19/16)
16.2% (.EXE) Win64 Executable (generic) (10523/12/4)
7.7% (.EXE) Win16 NE executable (generic) (5038/12/1)
3.1% (.EXE) OS/2 Executable (generic) (2029/13)
3.0% (.EXE) Generic Win/DOS Executable (2002/3)
File icon (PE):PE icon
dhash icon d6928b39990d5d7b (2 x Gh0stRAT)
Reporter ankit_anubhav
Tags:exe Gh0stRAT kk123456.top pystealer

Intelligence

File Origin
# of uploads :
4
# of downloads :
325
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
joe.exe
Verdict:
No threats detected
Analysis date:
2022-06-06 09:50:58 UTC
Tags:
installer
Link:
https://app.any.run/tasks/f6161046-7f1f-486d-b429-6f60bbdc4518

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.Agent.Script.1713931.10438.20114.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% subdirectories
Creating a file
Creating a window
Query of malicious DNS domain
Sending an HTTP GET request to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
expand.exe greyware overlay packed
Link:
https://www.filescan.io/uploads/629dcd555dc88d3571643ece/reports/97995832-c2ae-48e3-9879-4b9f3390f870/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5d89446a-0840-4832-a49f-3d4bdab517a3
Result
Threat name:
GhostRat
Create hunting rule
Detection:
malicious
Classification:
troj.spyw
Score:
76 / 100
Link:
https://www.joesandbox.com/analysis/1007235
Signature
Antivirus / Scanner detection for submitted sample
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected GhostRat
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3d277a4e25e92651aef2acf0e21f1f84e36909de2b4d3dd27b77539b0332ca57/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2022-06-02 19:52:36 UTC
File Type:
PE+ (Exe)
Extracted files:
1810
AV detection:
8 of 26 (30.77%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hutxutrf5etfdlxsvtyoehy7qtrwsco6fngt3ut3o5jzwazszjlq._file
Verdict:
suspicious
Label(s):
cobaltstrike
Create hunting rule
Similar samples:
089b3975338c69d1c8ae96cec13328459e8208c7cf9c88ce98896b90697c140b
Gh0stRAT
1a9d8e0f73b132cec42a383b06fc86cc73e451a653ef93a693e6738321648539
Gh0stRAT
314f7cd6f05ec806c204001478d0498bcaed44acb7648f4961faabef6562fe47
Gh0stRAT
476a05d5c8ef4444f96cbd02c3a315c56227b7510f75e82249a449bb79e977fc
Gh0stRAT
4b56d8713523dea09695ec6beef98608c234e5f8a9be77be931a687c080fb0f1
Gh0stRAT
684aa3d044556d1883bed06b737a297eac301d14872e1813b0e5cd78cefaa95d
Gh0stRAT
774c3c82a6ba75819070cca4d14f0df9329ebfe5b4dbb2e61423f95281ae7e6d
Gh0stRAT
8d3c6da3f4d6513a1d38058a6cf6028e0c07210a5c0509f47150152362093636
Gh0stRAT
906d1ee4c61e1fa0b1417bbf60d5087ceb1e817a75d314b8471099d0a89e8575
Gh0stRAT
b6bfb18cb265786cbf4373a6dc82d4b8ec586d90f6a6e2cc72a1a3d20b60dda9
Gh0stRAT
+ 44 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
pyinstaller spyware stealer
Link:
https://tria.ge/reports/220606-lsr4labecl/
Behaviour
Suspicious use of WriteProcessMemory
Loads dropped DLL
Reads user/profile data of web browsers
Unpacked files
SH256 hash:
3d277a4e25e92651aef2acf0e21f1f84e36909de2b4d3dd27b77539b0332ca57
MD5 hash:
fd757131ebee36c55d5415294d598538
SHA1 hash:
6ceefe311e072dc87b618c50dd806abb7b38922c
Link:
https://www.unpac.me/results/745c56e5-5704-48dc-82a2-812e7e6241ed/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/3d277a4e25e92651aef2acf0e21f1f84e36909de2b4d3dd27b77539b0332ca57

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:PyInstaller
Create hunting rule
Author:@bartblaze
Description:Identifies executable converted using PyInstaller.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments