MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4f5c281124d2e9ce43ebf84c3dbf19da88617e5cf58077db3ac3a042dc3c60df. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gh0stRAT

Vendor detections: 11

Intelligence 11 IOCs YARA 7 File information Comments

SHA256 hash:	4f5c281124d2e9ce43ebf84c3dbf19da88617e5cf58077db3ac3a042dc3c60df
SHA3-384 hash:	7a293e01205f18e6644e7aa0c46e707e89fd12073b7dc8c4676ca2122003398ef4cdcc4f7fe556135dcecefe6ef7c199
SHA1 hash:	29ea0c3bbf5f2f6e39a3c87766408d8e0466a83d
MD5 hash:	d9183a617c400e9531a9f24794c85ace
humanhash:	xray-high-batman-fillet
File name:	Gogesuchourua-ang.msi
Download:	download sample
Signature	Gh0stRAT Create hunting rule
File size:	38'081'536 bytes
First seen:	2025-03-07 17:38:10 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	786432:hxsPS5BrnSTdAplKQ5jXY/TDEUgtr8AG9Rcjo78LhrFt+fnOtCZU1MDD541VMu:hxsa5B7uaTlU+9o7WFsfnRUmny1t
TLSH	T169872321359DC132F66F05B19A29DA2AE47D7DE20B7004EB93F4F95A6A310C25339F93
TrID	80.0% (.MSI) Microsoft Windows Installer (454500/1/170) 10.7% (.MST) Windows SDK Setup Transform script (61000/1/5) 7.8% (.MSP) Windows Installer Patch (44509/10/5) 1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	aachum
Tags:	Gh0stRAT mimikatz msi Nitol

iamaachum

https://ymsk.ejfiwf.cn/llq/Gogesuchourua-ang.zip

C2: fs-im-kefu.7moor-fs1.com

Intelligence

File Origin

# of uploads :

# of downloads :

103

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67cb370cc668b65489bfe4b8

Tags:

backdoor virus blic

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

adaptive-context anti-vm cmd evasive fingerprint fingerprint keylogger lolbin msiexec remote runonce wix

Link:

https://www.filescan.io/uploads/67cb2f0b4a3011c802ca8306/reports/35beedae-c38b-4c16-b60f-62484aefc714/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/4f5c281124d2e9ce43ebf84c3dbf19da88617e5cf58077db3ac3a042dc3c60df

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/4f5c281124d2e9ce43ebf84c3dbf19da88617e5cf58077db3ac3a042dc3c60df

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

n/a

Detection:

malicious

Classification:

n/a

Score:

48 / 100

Link:

https://www.joesandbox.com/analysis/1632104

Signature

Multi AV Scanner detection for submitted file

Behaviour

Behavior Graph:

Download SVG

Score:

94%

Verdict:

Malware

File Type:

Result

Malware family:

n/a

Score:

6/10

Tags:

discovery persistence privilege_escalation

Link:

https://tria.ge/reports/250307-v7vbyatyct/

Behaviour

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Event Triggered Execution: Installer Packages

System Location Discovery: System Language Discovery

Loads dropped DLL

Enumerates connected drives

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/8d4d740a-f060-4002-a9d2-bce6eae21759

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4f5c281124d2e9ce43ebf84c3dbf19da88617e5cf58077db3ac3a042dc3c60df

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	Detect_LATAM_MSI_Banker Create hunting rule

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	suspicious_msi_file Create hunting rule
Author:	Johnk3r
Description:	Detects common strings, DLL and API in Banker_BR

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)