MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5ca996852ea49ac1c7d475101ce0c354088436053090d05ce44a7eff5ad267af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gh0stRAT


Vendor detections: 12


Intelligence 12 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5ca996852ea49ac1c7d475101ce0c354088436053090d05ce44a7eff5ad267af
SHA3-384 hash: 11be5d884889b93a229f6adfa5aeaa0c72994ca93ea124f4179a642ad47d016bb220b401f7971c2efb7f2c5a8847e3e0
SHA1 hash: 2ae7dd65f94d0bf2c4de17cc779ae20eb4c291ab
MD5 hash: ae216ebc05ce85366b24044d410aff7b
humanhash: earth-butter-moon-kansas
File name:down.exe
Download: download sample
Signature Gh0stRAT
Create hunting rule
File size:6'426'624 bytes
First seen:2024-07-25 15:54:52 UTC
Last seen:2024-07-25 16:27:32 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash b34c1f24c7adca506381a87250e81b21 (1 x Gh0stRAT)
ssdeep 6144:cYV4qF3Y0QqoHZ1UrjVuQUc2rPNkgr2DhCMSay6SO/NTsUu:czqjW12VecKWy6SUpsUu
Threatray 3 similar samples on MalwareBazaar
TLSH T1175673217440D957C6E6B1B24D8BF2B818947C19FE04DD0BB6E0BBAFF4B68D2A611317
TrID 37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
12.7% (.EXE) Win64 Executable (generic) (10523/12/4)
7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
File icon (PE):PE icon
dhash icon 8aaabab2caf2fe7a (7 x Gh0stRAT, 1 x YoungLotus)
Reporter Anonymous
Tags:exe Gh0stRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
377
Origin country :
US US
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Win32.MalwareX-gen.9768.1893.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66a34f2b458e130e002a95b5
Tags:
Execution Generic Infostealer Network Static Stealth Plugx
Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Creating a file
Running batch commands
Creating a process with a hidden window
Сreating synchronization primitives
Searching for the window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
89%
Tags:
epmicrosoft_visual_cc lolbin microsoft_visual_cc shell32
Link:
https://www.filescan.io/uploads/66a2755b9149fd55f9909760/reports/a02d6090-e8a8-491f-a520-ef38892cadc5/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
GhostRat, Mimikatz, Nitol
Create hunting rule
Detection:
malicious
Classification:
rans.troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1482143
Behaviour
Behavior Graph:
n/a
Score:
65%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/5ca996852ea49ac1c7d475101ce0c354088436053090d05ce44a7eff5ad267af
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5ca996852ea49ac1c7d475101ce0c354088436053090d05ce44a7eff5ad267af/
Threat name:
Win32.Backdoor.Gulpix
Create hunting rule
Status:
Malicious
First seen:
2024-07-25 12:44:02 UTC
File Type:
PE (Exe)
Extracted files:
72
AV detection:
19 of 38 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lsuznbjousnmdr6uouibzygdkqeiinqfgcinaxhejj7p6wwsm6xq._file
Verdict:
malicious
Similar samples:
30dec607ab102bfab86c5edfee2f412def56c935b236126316fd3f396abab8fa
Gh0stRAT
e65ce5d4d20836181fbc041ca28853c89946013e1ab7fcd7e0bb58442f274e0d
Gh0stRAT
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/240725-tcr3nasbmh/
Behaviour
Suspicious use of SetWindowsHookEx
System Location Discovery: System Language Discovery
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/543faa02-a9b4-4254-9a66-f44c3c05b8db
Unpacked files
SH256 hash:
5ca996852ea49ac1c7d475101ce0c354088436053090d05ce44a7eff5ad267af
MD5 hash:
ae216ebc05ce85366b24044d410aff7b
SHA1 hash:
2ae7dd65f94d0bf2c4de17cc779ae20eb4c291ab
Link:
https://www.unpac.me/results/f5e2d3bb-809b-40c5-a923-6ac2d09d1827/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/5ca996852ea4/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5ca996852ea49ac1c7d475101ce0c354088436053090d05ce44a7eff5ad267af

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CoCreateInstance
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
WININET.dll::InternetCloseHandle
WIN_BASE_APIUses Win Base APIKERNEL32.dll::LoadLibraryA
KERNEL32.dll::GetStartupInfoA
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CreateFileA
WIN_USER_APIPerforms GUI ActionsUSER32.dll::FindWindowA

Comments