MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4cc270dbafe0d3d357d2f1bb73ee208d258c6f10229abd98d8f9f4326a7176c9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gh0stRAT


Vendor detections: 8


Intelligence 8 IOCs 1 YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4cc270dbafe0d3d357d2f1bb73ee208d258c6f10229abd98d8f9f4326a7176c9
SHA3-384 hash: 541cfab7089629acebcb995248fff8be1ad779372e71056001b8936cc1276419f823269f417504e5f8367a5b726386d3
SHA1 hash: b36c94776fe8f577ba8c7e4446722bdbcec92bf8
MD5 hash: f5514bc619d611bda2c2969202fe0669
humanhash: jig-zulu-football-fifteen
File name:4cc270dbafe0d3d357d2f1bb73ee208d258c6f10229ab.dll
Download: download sample
Signature Gh0stRAT
Create hunting rule
File size:21'318'144 bytes
First seen:2022-07-18 06:00:43 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash 6db0b852a0f78ce52a5de071e0915858 (2 x Gh0stRAT)
ssdeep 393216:xdsJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJJz:M
TLSH T16D27E141757B74C1E1945BE72987BCFC74623338A9A1061230D7380E9BBD39E9E6923B
TrID 33.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
17.6% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
14.0% (.SCR) Windows screen saver (13101/52/3)
11.2% (.EXE) Win64 Executable (generic) (10523/12/4)
7.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
Reporter abuse_ch
Tags:dll Gh0stRAT


Avatar
abuse_ch
Gh0stRAT C2:
183.236.2.18:1994

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
183.236.2.18:1994 https://threatfox.abuse.ch/ioc/838395/

Intelligence

File Origin
# of uploads :
1
# of downloads :
250
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
Win.Trojan.Magania-12843
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a service
Creating a file
Creating a file in the Program Files subdirectories
Enabling the 'hidden' option for recently created files
Launching a service
DNS request
Sending a custom TCP request
Enabling autorun for a service
Gathering data
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad.troj
Score:
96 / 100
Link:
https://www.joesandbox.com/analysis/1035499
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Changes security center settings (notifications, updates, antivirus, firewall)
Contains functionality to detect sleep reduction / modifications
Machine Learning detection for dropped file
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Query firmware table information (likely to detect VMs)
System process connects to network (likely due to code injection or exploit)
Uses dynamic DNS services
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 667994 Sample: 4cc270dbafe0d3d357d2f1bb73e... Startdate: 18/07/2022 Architecture: WINDOWS Score: 96 48 Antivirus detection for dropped file 2->48 50 Antivirus / Scanner detection for submitted sample 2->50 52 Multi AV Scanner detection for submitted file 2->52 54 3 other signatures 2->54 7 loaddll32.exe 3 2->7         started        9 svchost.exe 2->9         started        13 svchost.exe 2->13         started        15 14 other processes 2->15 process3 dnsIp4 17 cmd.exe 1 7->17         started        19 rundll32.exe 1 3 7->19         started        22 rundll32.exe 1 2 7->22         started        26 5 other processes 7->26 42 yang8963156.3322.org 183.236.2.18, 1994 CMNET-GUANGDONG-APChinaMobilecommunicationscorporation China 9->42 58 System process connects to network (likely due to code injection or exploit) 9->58 60 Changes security center settings (notifications, updates, antivirus, firewall) 13->60 24 MpCmdRun.exe 13->24         started        44 127.0.0.1 unknown unknown 15->44 62 Query firmware table information (likely to detect VMs) 15->62 signatures5 process6 signatures7 28 rundll32.exe 2 3 17->28         started        56 Contains functionality to detect sleep reduction / modifications 19->56 31 WerFault.exe 2 9 22->31         started        34 conhost.exe 24->34         started        36 WerFault.exe 23 9 26->36         started        process8 dnsIp9 38 C:\Program Files (x86)\Irrs\Chvhopfpg.gif, PE32 28->38 dropped 40 C:\...\Chvhopfpg.gif:Zone.Identifier, ASCII 28->40 dropped 46 192.168.2.1 unknown unknown 31->46 file10
Gathering data
Threat name:
Win32.Backdoor.Farfli
Create hunting rule
Status:
Malicious
First seen:
2022-06-05 17:22:00 UTC
File Type:
PE (Dll)
Extracted files:
3
AV detection:
24 of 26 (92.31%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jtbhbw5p4dj5gv6s6g5xh3rarusyy3yqeknl3ggy7h2de2tro3eq._file
Verdict:
malicious
Result
Malware family:
gh0strat
Create hunting rule
Score:
  10/10
Tags:
family:gh0strat rat suricata
Link:
https://tria.ge/reports/220718-gqwxjsbaer/
Behaviour
Checks processor information in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Drops file in Program Files directory
Loads dropped DLL
Gh0st RAT payload
Gh0strat
suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic
suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 102
suricata: ET MALWARE Gh0st Remote Access Trojan Encrypted Session To CnC Server
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/4cc270dbafe0/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4cc270dbafe0d3d357d2f1bb73ee208d258c6f10229abd98d8f9f4326a7176c9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments