🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 542b86f0589312bf0e15096a5666b2e54630bcd458e2d02035b2fee39963a8fb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gh0stRAT


Vendor detections: 15


Intelligence 15 IOCs 1 YARA 14 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 542b86f0589312bf0e15096a5666b2e54630bcd458e2d02035b2fee39963a8fb
SHA3-384 hash: 1587cadd7e5e1280116eba0c172819e807a858670e178651db9e7b266da73c4218e283199f415ff1fc44cbed4548f161
SHA1 hash: 14828fc42f647b81f7a4371df9608042d1cc719c
MD5 hash: b6cc2fd3e74c2a92d15f091ef1238312
humanhash: kansas-carbon-glucose-diet
File name:B6CC2FD3E74C2A92D15F091EF1238312.exe
Download: download sample
Signature Gh0stRAT
Create hunting rule
File size:466'944 bytes
First seen:2026-10-22 06:35:15 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash f48a37a09b604839705fa2947a716d67 (3 x Gh0stRAT)
ssdeep 12288:rcz3GHYBCxMmSoaRwDNIUAzmER9KHgm9+TJzFN7:rgW4B6MVoaaDNFK9ef+TJzF
TLSH T182A4D020BAB1C132D4E2927189FAEA35586DB471072945CB73D91BBD2D343E1BB3538B
TrID 50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.5% (.EXE) Win64 Executable (generic) (6522/11/2)
8.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
Reporter abuse_ch
Tags:exe Gh0stRAT RAT


Avatar
abuse_ch
Gh0stRAT C2:
211.154.24.12:6000

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
211.154.24.12:6000 https://threatfox.abuse.ch/ioc/1979193/

Intelligence

File Origin
# of uploads :
1
# of downloads :
161
Origin country :
NL NL
Vendor Threat Intelligence
Malware configuration found for:
ValleyFall
Details
Link:
https://research.acce.ciphertechsolutions.com/results/ecec9d9c-552b-4507-9b19-0bf6cb22037e/
Malware family:
gh0st
Create hunting rule
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-10-22 06:47:49 UTC
Tags:
rat gh0st auto-reg
Link:
https://app.any.run/tasks/69cf1978-3f8b-4f73-88ce-cc9f661fdd5a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/93946/
Detection(s):
PUA.Win.Packer.PrivateExeProte-11
Create hunting rule

Win.Malware.Farfli-10038346-0
Create hunting rule

Win.Malware.Fragtor-10002223-0
Create hunting rule

Win.Malware.Fragtor-10038352-0
Create hunting rule

Win.Malware.Mikey-10017473-0
Create hunting rule

Win.Malware.Spvpk-10020118-0
Create hunting rule

YARA.R3C0NST_Aplib_Decompression.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad9aeacafb06e650cd89287
Tags:
vmdetect farfli
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file
Enabling the 'hidden' option for recently created files
Connection attempt
DNS request
Creating synchronization primitives
Searching for the window
Sending a custom TCP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug anti-vm downloader evasive fingerprint ghostrat ghostrat keylogger microsoft_visual_cc packed reconnaissance remoteaccesstool
Link:
https://www.filescan.io/uploads/6ad9aea9d36dde530eba5553/reports/65aec8ea-80b4-4cc4-a555-a804e941ee54/overview
Verdict:
Malicious
Labled as:
Dump:Generic.Malware.SPVPk
Link:
https://www.hybrid-analysis.com/sample/542b86f0589312bf0e15096a5666b2e54630bcd458e2d02035b2fee39963a8fb
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-10-19T07:09:00Z UTC
Last seen:
2026-10-23T18:36:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/542b86f0589312bf0e15096a5666b2e54630bcd458e2d02035b2fee39963a8fb/results?tab=lookup
Malware family:
ValleyRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/471865cd-2a9b-4c5c-81d9-c1a1a5e7c2fe
Result
Threat name:
GhostRat
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1990432
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Contain functionality to detect virtual machines
Contains functionality to access PhysicalDrive, possible boot sector overwrite
Contains functionality to infect the boot sector
Found API chain indicative of debugger detection
Found API chain indicative of sandbox detection
Found malware configuration
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected GhostRat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1990432 Sample: kG0UJ34i9x.exe Startdate: 22/10/2026 Architecture: WINDOWS Score: 100 32 mr-b01.tm-azurefd.net 2->32 34 casoneroutegold-prod-bggfgca0dkaag8a8.b01.azurefd.net 2->34 36 2000.ink 2->36 42 Found malware configuration 2->42 44 Antivirus / Scanner detection for submitted sample 2->44 46 Multi AV Scanner detection for submitted file 2->46 48 3 other signatures 2->48 7 kG0UJ34i9x.exe 3 2 2->7         started        12 Server.exe 2 2->12         started        14 Server.exe 2 2->14         started        signatures3 process4 dnsIp5 38 2000.ink 34.41.139.193, 1125, 49702, 49717 GOOGLE-CLOUD-PLATFORM-GoogleLLCUS United States 7->38 40 211.154.24.12, 49701, 49716, 49722 FXNETHubeiFeixunNetworkCoLtdCN China 7->40 26 C:\ProgramData\Microsoft\Server.exe, PE32 7->26 dropped 28 C:\ProgramData\...\Server.exe:Zone.Identifier, ASCII 7->28 dropped 50 Contains functionality to access PhysicalDrive, possible boot sector overwrite 7->50 52 Found API chain indicative of debugger detection 7->52 54 Found API chain indicative of sandbox detection 7->54 56 Contain functionality to detect virtual machines 7->56 16 WerFault.exe 21 18 7->16         started        58 Antivirus detection for dropped file 12->58 60 Multi AV Scanner detection for dropped file 12->60 62 Contains functionality to infect the boot sector 12->62 20 WerFault.exe 21 12->20         started        22 WerFault.exe 21 14->22         started        file6 signatures7 process8 dnsIp9 30 mr-b01.tm-azurefd.net 150.171.110.17, 443, 49715, 49718 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS United States 16->30 24 C:\ProgramData\Microsoft\...\Report.wer, TeX 16->24 dropped file10
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/542b86f0589312bf0e15096a5666b2e54630bcd458e2d02035b2fee39963a8fb
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/b6cc2fd3e74c2a92d15f091ef1238312
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/542b86f0589312bf0e15096a5666b2e54630bcd458e2d02035b2fee39963a8fb/
Threat name:
Win32.Trojan.AntiAV
Create hunting rule
Status:
Malicious
First seen:
2026-10-18 12:54:00 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
33 of 38 (86.84%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kqvyn4cysmjl6dqvbfvfmzvs4vddbpguldrnaibvwl7ohgldvd5q._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery persistence
Link:
https://tria.ge/reports/261022-hchnfaaw3y/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Enumerates video capture drivers
Adds Run key to start application
Enumerates connected drives
Executes dropped EXE
Unpacked files
SH256 hash:
542b86f0589312bf0e15096a5666b2e54630bcd458e2d02035b2fee39963a8fb
MD5 hash:
b6cc2fd3e74c2a92d15f091ef1238312
SHA1 hash:
14828fc42f647b81f7a4371df9608042d1cc719c
Link:
https://www.unpac.me/results/8bb1d8f9-fc48-49c0-a03d-6daf39470c48/
SH256 hash:
8829f200a0bf201dd2ca2c4f8d63a5d0538832da0f866878f18e8bdc2b910f35
MD5 hash:
3550ebf2892803e1a2aadef9893b6c25
SHA1 hash:
31f60102b818ff1bc000b5bdfa19795937a7e23c
Link:
https://www.unpac.me/results/8bb1d8f9-fc48-49c0-a03d-6daf39470c48/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/542b86f0589312bf0e15096a5666b2e54630bcd458e2d02035b2fee39963a8fb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:aPLib_decompression
Create hunting rule
Author:@r3c0nst
Description:Detects aPLib decompression code often used in malware
Reference:https://ibsensoftware.com/files/aPLib-1.1.1.zip
Rule name:Check_DriveSize
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:Gh0stKCP
Create hunting rule
Author:Netresec
Description:Detects HP-Socket ARQ and KCP implementations, which are used in Gh0stKCP. Forked from @stvemillertime's KCP catchall rule.
Reference:https://netresec.com/?b=259a5af
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:Windows_Trojan_DustyWarehouse_a6cfc9f7
Create hunting rule
Author:Elastic Security
Rule name:WIN_Malware_ACRStealer_ForgeAuto_1084c837_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects ACRStealer (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_74566f98
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_79234c04
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/93946/

Comments