MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5cc140e5dc2a73a4e5f3c1f728257b3a8398e7523a44c449c58efc347fbc9a91. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gh0stRAT


Vendor detections: 13


Intelligence 13 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5cc140e5dc2a73a4e5f3c1f728257b3a8398e7523a44c449c58efc347fbc9a91
SHA3-384 hash: 7d2c84aa38586607ac1d0e660ad5618df5047fd112e031328127dc0f8237ac19b96907eef97e24ef166e1ef550f1ab6c
SHA1 hash: a8d4b15249ee568a38b6b5a29fd4db9d3fe2ff34
MD5 hash: 60a87e7be6cdde4f59a92b656adc3acb
humanhash: bluebird-juliet-high-football
File name:setup搜狗拼音输入法_11_4002071.exe
Download: download sample
Signature Gh0stRAT
Create hunting rule
File size:778'240 bytes
First seen:2024-07-26 09:11:32 UTC
Last seen:2024-07-26 09:37:15 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash 59991b3e03d768e4564f52de6b13925f (1 x Gh0stRAT)
ssdeep 12288:fQT9crtpwD8HeAP2MgBvGEOD7neJnTpliYF1i/QN19VNo:vHP2MgBvlOD7eJV71to
TLSH T134F49E3A31D1C0BBC27341714EA47B76A6FEFA650FB58AC767808B5D0E3A4C15E36126
TrID 31.5% (.EXE) InstallShield setup (43053/19/16)
22.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
12.1% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
9.5% (.SCR) Windows screen saver (13097/50/3)
7.7% (.EXE) Win64 Executable (generic) (10523/12/4)
Reporter vm001cn
Tags:exe gh0st Gh0stRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
388
Origin country :
US US
Vendor Threat Intelligence
Malware family:
gh0st
Create hunting rule
ID:
1
File name:
setup搜狗拼音输入法_11_4002071.exe
Verdict:
Malicious activity
Analysis date:
2024-07-26 09:09:51 UTC
Tags:
installer remote rat gh0st sainbox backdoor
Link:
https://app.any.run/tasks/2ff482c7-b9b4-441c-a2e0-334c79fffc25

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Win32.BackdoorX-gen.15903.17338.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=66a3687781e42e2b16c7b390
Tags:
Execution Generic Infostealer Network Static Stealth Zpack
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
DNS request
Connection attempt
Sending a custom TCP request
Sending an HTTP GET request
Creating a file
Modifying an executable file
Running batch commands
Creating a process with a hidden window
Сreating synchronization primitives
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/4b967548-c2f3-4611-a2b1-3369646b5aac
Result
Threat name:
GhostRat, Mimikatz, Nitol
Create hunting rule
Detection:
malicious
Classification:
rans.troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1482912
Signature
AI detected suspicious sample
Antivirus / Scanner detection for submitted sample
Contains functionality to detect sleep reduction / modifications
Found evasive API chain (may stop execution after checking mutex)
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sample is not signed and drops a device driver
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Windows Shell/Scripting Application File Write to Suspicious Folder
Writes a notice file (html or txt) to demand a ransom
Yara detected GhostRat
Yara detected Mimikatz
Yara detected Nitol
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1482912 Sample: setup#U641c#U72d7#U62fc#U97... Startdate: 26/07/2024 Architecture: WINDOWS Score: 100 29 fs-im-kefu.7moor-fs1.com 2->29 31 vod-all.ipv4.qiniu.com.volcgslb.com 2->31 33 3 other IPs or domains 2->33 39 Malicious sample detected (through community Yara rule) 2->39 41 Antivirus / Scanner detection for submitted sample 2->41 43 Multi AV Scanner detection for dropped file 2->43 45 7 other signatures 2->45 8 setup#U641c#U72d7#U62fc#U97f3#U8f93#U5165#U6cd5_11_4002071.exe 3 26 2->8         started        signatures3 process4 dnsIp5 35 38.46.15.242, 49705, 9990 COGENT-174US United States 8->35 37 sz-qiniu-v4.volcgtm.com 36.158.216.227, 443, 49704, 49706 CMNET-HUNAN-APChinaMobilecommunicationscorporationCN China 8->37 21 C:\Users\user\AppData\Local\...\5[1].txt, PE32 8->21 dropped 23 C:\Users\user\AppData\Local\...\6[1].txt, PE32 8->23 dropped 25 C:\Users\user\AppData\Local\...\1[1].txt, PE32+ 8->25 dropped 27 4 other malicious files 8->27 dropped 47 Found evasive API chain (may stop execution after checking mutex) 8->47 49 Writes a notice file (html or txt) to demand a ransom 8->49 51 Sample is not signed and drops a device driver 8->51 53 Contains functionality to detect sleep reduction / modifications 8->53 13 cmd.exe 2 8->13         started        15 cmd.exe 8->15         started        file6 signatures7 process8 process9 17 conhost.exe 13->17         started        19 conhost.exe 15->19         started       
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/5cc140e5dc2a73a4e5f3c1f728257b3a8398e7523a44c449c58efc347fbc9a91
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5cc140e5dc2a73a4e5f3c1f728257b3a8398e7523a44c449c58efc347fbc9a91/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2024-07-26 08:35:17 UTC
File Type:
PE (Exe)
Extracted files:
18
AV detection:
23 of 38 (60.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ltaubzo4fjz2jzptyh3sqjl3hkbzrz2shjcmisofr36di754tkiq._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/240726-k56l3sydkj/
Behaviour
Suspicious use of SetWindowsHookEx
System Location Discovery: System Language Discovery
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/5c79f4a5-8d2f-4d85-8549-3cb1d76b69fd
Unpacked files
SH256 hash:
5cc140e5dc2a73a4e5f3c1f728257b3a8398e7523a44c449c58efc347fbc9a91
MD5 hash:
60a87e7be6cdde4f59a92b656adc3acb
SHA1 hash:
a8d4b15249ee568a38b6b5a29fd4db9d3fe2ff34
Link:
https://www.unpac.me/results/181e7fd6-185d-44f6-967e-c689ae167a6e/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/5cc140e5dc2a/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/5cc140e5dc2a73a4e5f3c1f728257b3a8398e7523a44c449c58efc347fbc9a91

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_NXMissing Non-Executable Memory Protectioncritical
CHECK_PIEMissing Position-Independent Executable (PIE) Protectionhigh
Reviews
IDCapabilitiesEvidence
COM_BASE_APICan Download & Execute componentsole32.dll::CLSIDFromProgID
ole32.dll::CoCreateInstance
ole32.dll::CoFreeUnusedLibraries
ole32.dll::CreateStreamOnHGlobal
MULTIMEDIA_APICan Play MultimediaGDI32.dll::StretchDIBits
SHELL_APIManipulates System ShellSHELL32.dll::SHGetFileInfoA
WIN32_PROCESS_APICan Create Process and ThreadsKERNEL32.dll::CloseHandle
WININET.dll::InternetCloseHandle
KERNEL32.dll::CreateThread
WIN_BASE_APIUses Win Base APIKERNEL32.dll::TerminateProcess
KERNEL32.dll::LoadLibraryA
KERNEL32.dll::GetVolumeInformationA
KERNEL32.dll::GetStartupInfoA
KERNEL32.dll::GetDiskFreeSpaceA
KERNEL32.dll::GetCommandLineA
WIN_BASE_EXEC_APICan Execute other programsKERNEL32.dll::SetConsoleCtrlHandler
KERNEL32.dll::SetStdHandle
WIN_BASE_IO_APICan Create FilesKERNEL32.dll::CopyFileA
KERNEL32.dll::CreateFileA
KERNEL32.dll::DeleteFileA
ADVAPI32.dll::GetFileSecurityA
KERNEL32.dll::MoveFileA
ADVAPI32.dll::SetFileSecurityA
WIN_REG_APICan Manipulate Windows RegistryADVAPI32.dll::RegCreateKeyExA
ADVAPI32.dll::RegCreateKeyA
ADVAPI32.dll::RegDeleteKeyA
ADVAPI32.dll::RegOpenKeyA
ADVAPI32.dll::RegOpenKeyExA
ADVAPI32.dll::RegQueryValueExA
ADVAPI32.dll::RegQueryValueA
WIN_USER_APIPerforms GUI ActionsUSER32.dll::AppendMenuA
USER32.dll::FindWindowA
USER32.dll::PeekMessageA
USER32.dll::CreateWindowExA

Comments