MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 45c3def87b7c9a748044bc2384ae52de40b83c401c39d0c3074af8ceff55961d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gh0stRAT

Vendor detections: 5

Intelligence 5 IOCs YARA 3 File information Comments

SHA256 hash:	45c3def87b7c9a748044bc2384ae52de40b83c401c39d0c3074af8ceff55961d
SHA3-384 hash:	6fc992e2896c439a0d0b7f8f2e2880008f9342c672966b8790c5f1b916f476e903d72a7957cb2a1e50bf66fb86c6d1d1
SHA1 hash:	56e508cd298c1b158518e71af7f0d057b9c504cb
MD5 hash:	c1f85f7e2b152853592d3ed8625eab34
humanhash:	floor-yellow-potato-harry
File name:	C6YA3FER.bat
Download:	download sample
Signature	Gh0stRAT Create hunting rule
File size:	1'338 bytes
First seen:	2022-12-16 14:30:33 UTC
Last seen:	Never
File type:	bat
MIME type:	text/plain
ssdeep	24:7xXOowJlURzKghCqhJoV7ccV3M/9um1B+Vl9RZLDltUgt6LH9:pOoklUR2gwq7oV7n+lfn+JL/ltUgt8
TLSH	T14A21EE727453F247DAB01415887E3701770EF9077D905D4AA2B4B8E4F8C24869A183DD
Reporter	iamdeadlyz
Tags:	45-153-241-207 bat FakeGaliXCity Gh0stRAT SpaceCity

Iamdeadlyz

From spacecity.games (impersonation of galixcity.io)
Gh0stRAT C&C: 45.153.241.207:1016

Intelligence

File Origin

# of uploads :

# of downloads :

123

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

SpaceCity.exe

Verdict:

No threats detected

Analysis date:

2022-12-16 14:30:22 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/cbd090b1-5794-4697-aec5-0e010ac9d3dc

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/347015/

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Sending a custom TCP request

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-debug evasive explorer.exe greyware keylogger packed shell32.dll

Link:

https://www.filescan.io/uploads/639c812873102ebf5216ad18/reports/b0874131-19fb-40ce-a7a8-bf1cf896c147/overview

Result

Verdict:

UNKNOWN

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/1135763

Signature

Malicious sample detected (through community Yara rule)

Yara detected Obfuscated Powershell

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/45c3def87b7c9a748044bc2384ae52de40b83c401c39d0c3074af8ceff55961d/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ixb556d3psnhjacexqryjlss3zalqpcadq45bqyhjl4m572vsyoq._file

Verdict:

unknown

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/221216-rvpzxahf6y/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Backdoor

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/45c3def87b7c9a748044bc2384ae52de40b83c401c39d0c3074af8ceff55961d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

Rule name:	SUSP_PowerShell_Caret_Obfuscation_2 Create hunting rule
Author:	Florian Roth
Description:	Detects powershell keyword obfuscated with carets
Reference:	Internal Research

Rule name:	SUSP_PowerShell_Caret_Obfuscation_2_RID347B Create hunting rule
Author:	Florian Roth
Description:	Detects powershell keyword obfuscated with carets
Reference:	Internal Research