MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 46bed426035dbd31cb6736dd3f573944d0c47e3d474b02fef43b537bf2ec2e3e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gh0stRAT


Vendor detections: 9


Intelligence 9 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 46bed426035dbd31cb6736dd3f573944d0c47e3d474b02fef43b537bf2ec2e3e
SHA3-384 hash: 1423e699e02e93c70a98ce400130a4cccd84a9fdd68bc3327d303b4ba5f666334495308148f100310fb27a96fd82a12a
SHA1 hash: 8416803e9819e46032a036b5d35d1ca628cf2b76
MD5 hash: 0f9e62354cf5353a7adcbe67cd3bcd93
humanhash: table-gee-oregon-utah
File name:0f9e62354cf5353a7adcbe67cd3bcd93.exe
Download: download sample
Signature Gh0stRAT
Create hunting rule
File size:159'744 bytes
First seen:2022-06-27 15:00:28 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash c8d8ab2105b98430234d0a20519aef66 (8 x Gh0stRAT, 1 x Expiro)
ssdeep 3072:edlKPwx3EuRHSBtL7/u+YuzkTESlTmkUe:edlnx+7/u+YuIbk
Threatray 19 similar samples on MalwareBazaar
TLSH T14DF36A1774F0BBB6C34382750F658A3BB2E9E13CDD124993634B6B491F34BD28E6A251
TrID 38.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
20.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
13.0% (.EXE) Win64 Executable (generic) (10523/12/4)
8.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.2% (.EXE) Win16 NE executable (generic) (5038/12/1)
Reporter abuse_ch
Tags:exe Gh0stRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
252
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/283633/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file in the Windows subdirectories
Creating a service
Launching a service
Launching a process
Searching for synchronization primitives
Creating a process from a recently created file
Creating a window
Sending a custom TCP request
Enabling autorun for a service
Moving of the original file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
greyware keylogger rundll32.exe shell32.dll wacatac
Link:
https://www.filescan.io/uploads/62b9c66fe88d6da4ffcc6eb1/reports/86dc9642-ef69-47ae-a672-c7efd14b0c78/overview
Malware family:
Farfli
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c2fbc27b-a82c-4f0a-88d5-8e53194e59dc
Result
Threat name:
GhostRat
Create hunting rule
Detection:
malicious
Classification:
bank.troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1020642
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Changes security center settings (notifications, updates, antivirus, firewall)
Checks if browser processes are running
Contains functionality to capture and log keystrokes
Contains functionality to detect sleep reduction / modifications
Creates a Windows Service pointing to an executable in C:\Windows
Drops executables to the windows directory (C:\Windows) and starts them
Found evasive API chain (may stop execution after checking mutex)
Machine Learning detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected GhostRat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 653133 Sample: QABqf4Xbw3.exe Startdate: 27/06/2022 Architecture: WINDOWS Score: 100 35 Antivirus detection for dropped file 2->35 37 Antivirus / Scanner detection for submitted sample 2->37 39 Multi AV Scanner detection for submitted file 2->39 41 6 other signatures 2->41 7 svchost.exe 2->7         started        10 svchost.exe 1 2->10         started        13 QABqf4Xbw3.exe 4 2 2->13         started        15 11 other processes 2->15 process3 dnsIp4 43 Checks if browser processes are running 7->43 45 Contains functionality to capture and log keystrokes 7->45 47 Contains functionality to detect sleep reduction / modifications 7->47 25 C:\Windows\SysWOW64\windows            .exe, PE32 10->25 dropped 49 Drops executables to the windows directory (C:\Windows) and starts them 10->49 18 windows            .exe 10->18         started        27 C:\Windows\SysWOW64\4803625.jpg, PE32 13->27 dropped 51 Creates a Windows Service pointing to an executable in C:\Windows 13->51 31 127.0.0.1 unknown unknown 15->31 33 192.168.2.1 unknown unknown 15->33 53 Changes security center settings (notifications, updates, antivirus, firewall) 15->53 21 MpCmdRun.exe 1 15->21         started        file5 signatures6 process7 dnsIp8 29 101.43.5.87, 2022, 49745 CNIX-APChinaNetworksInter-ExchangeCN China 18->29 23 conhost.exe 21->23         started        process9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/46bed426035dbd31cb6736dd3f573944d0c47e3d474b02fef43b537bf2ec2e3e/
Threat name:
Win32.Backdoor.Farfli
Create hunting rule
Status:
Malicious
First seen:
2022-05-19 20:39:00 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
24 of 26 (92.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=i27nijqdlw6tds3hg3ot6vzzitimi7r5i5fqf7xuhnjxx4xmfy7a._file
Verdict:
malicious
Similar samples:
0b3b7b1bf71efff25e6e6f4b1c0ff68c4505d76e82442d335790d3cfd2ded73a
Gh0stRAT
129d230573fdb00a681a7f0c507bc16d2efcd08c4408f544f1d7653162b2cd92
Gh0stRAT
1c602add0bd1296d58b6d64283cfd033163bbc5e210603a2dd8a8b1b725aa8ba
Gh0stRAT
28c67cdcd4523ca934a1b72c6c8f5ed39874b6b8f66e3f679cb1095f859f6e83
Gh0stRAT
6e025a1d72e2abfb9c0fb6c945d3fcdbe2124c5d68d8f5fb09b8389bc30f799e
Gh0stRAT
727bc43e3d9cdf3e79c2232cf3f647bdf94ad2012c31403434c17e5bbeb3c339
Gh0stRAT
d153e8b542963a9c9ae3fa96421f2ec2c5779759d0a086f3545b7e9c91074476
Gh0stRAT
d3501787751324e615bd13ed80417360fbd7558385662ac34c51b34802f9b9d4
Gh0stRAT
dd2348afaca2101fe4898391119d36e17ffe915efe10187d2085b06cbc8e1a12
Gh0stRAT
f836093baf3255830126881722dc2edd86fd615fc922f86d177b0ccb0e3d2941
Gh0stRAT
+ 9 additional samples on MalwareBazaar
Result
Malware family:
gh0strat
Create hunting rule
Score:
  10/10
Tags:
family:gh0strat persistence rat
Link:
https://tria.ge/reports/220627-sdvz9sdgd3/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: RenamesItself
Suspicious use of WriteProcessMemory
Drops file in System32 directory
Loads dropped DLL
Executes dropped EXE
Sets DLL path for service in the registry
Gh0st RAT payload
Gh0strat
Unpacked files
SH256 hash:
d2be0b5b38e794f90371be3a539925a86edc70d673f8b414d2473640f653459a
MD5 hash:
80ede5b5a019ff199fccee20fb5d0107
SHA1 hash:
b414c44f4f9c283b67b636541b0269102346305b
Link:
https://www.unpac.me/results/6e7adc77-71b0-4678-b192-44c202a631fe/
SH256 hash:
46bed426035dbd31cb6736dd3f573944d0c47e3d474b02fef43b537bf2ec2e3e
MD5 hash:
0f9e62354cf5353a7adcbe67cd3bcd93
SHA1 hash:
8416803e9819e46032a036b5d35d1ca628cf2b76
Link:
https://www.unpac.me/results/6e7adc77-71b0-4678-b192-44c202a631fe/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/46bed426035dbd31cb6736dd3f573944d0c47e3d474b02fef43b537bf2ec2e3e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/283633/

Comments