🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 68b218fd7fff25d1e49a2ae9d087bb323e09b0e04770ab518dddad89a454d520. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gh0stRAT


Vendor detections: 11


Intelligence 11 IOCs YARA 9 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 68b218fd7fff25d1e49a2ae9d087bb323e09b0e04770ab518dddad89a454d520
SHA3-384 hash: c5089c9fe785d5faeeb7832a2c1a0cfd3bdbf2159067a294dc7c442969484fcb0dd77c3712a1296eb3a27f9d808976b8
SHA1 hash: 48d88ca467667831cc43021a1f737c81f930ddb5
MD5 hash: 0c201153115c57ee4dd12fed94825984
humanhash: football-india-oxygen-kilo
File name:0C201153115C57EE4DD12FED94825984.exe
Download: download sample
Signature Gh0stRAT
Create hunting rule
File size:300'032 bytes
First seen:2023-11-28 07:25:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9d7ac77a44667ba5186f7bb12dfd9d42 (9 x Gh0stRAT)
ssdeep 6144:Epuk3SHEXJPSjiVJGZKZjwdFUcbZLSlHBNSem+tT9PTBHdo27D:Yv3Sk5PSmVGKZ8CHBN1mcT9PT/
TLSH T16D548D1076A0D532D4A2213689FADBB92D6EB471133951CB73C52F7E6E303E2667438B
TrID 52.9% (.EXE) Win32 Executable (generic) (4505/5/1)
23.5% (.EXE) Generic Win/DOS Executable (2002/3)
23.5% (.EXE) DOS Executable Generic (2000/1)
Reporter abuse_ch
Tags:exe Gh0stRAT


Avatar
abuse_ch
Gh0stRAT C2:
206.233.128.72:8899

Intelligence

File Origin
# of uploads :
1
# of downloads :
332
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/460869/
Detection(s):
Win.Malware.Fragtor-10002223-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Sending a custom TCP request
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-vm anti-vm control evasive greyware lolbin overlay shell32
Link:
https://www.filescan.io/uploads/6565960cfb43e835e6b7eab9/reports/7b61b01f-3569-4909-bb01-8b605feac3e1/overview
Verdict:
Malicious
Labled as:
DeepScan:Generic.Malware.SPVPk
Link:
https://www.hybrid-analysis.com/sample/68b218fd7fff25d1e49a2ae9d087bb323e09b0e04770ab518dddad89a454d520
Malware family:
ValleyRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/805e710f-2f34-4fee-bd75-c8a2522ce272
Result
Threat name:
n/a
Detection:
malicious
Classification:
evad
Score:
80 / 100
Link:
https://www.joesandbox.com/analysis/1349089
Signature
Antivirus / Scanner detection for submitted sample
Contain functionality to detect virtual machines
Contains functionality to access PhysicalDrive, possible boot sector overwrite
Contains functionality to infect the boot sector
Found API chain indicative of debugger detection
Found API chain indicative of sandbox detection
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/68b218fd7fff25d1e49a2ae9d087bb323e09b0e04770ab518dddad89a454d520
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/68b218fd7fff25d1e49a2ae9d087bb323e09b0e04770ab518dddad89a454d520/
Threat name:
Win32.Trojan.AntiVm
Create hunting rule
Status:
Malicious
First seen:
2023-11-19 16:08:00 UTC
File Type:
PE (Exe)
Extracted files:
1
AV detection:
33 of 37 (89.19%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nczbr7l774s5dze2flu5bb53gi7atmhai5ykwumn3wwytjcu2uqa._file
Verdict:
malicious
Result
Malware family:
n/a
Score:
  6/10
Tags:
n/a
Link:
https://tria.ge/reports/231128-h9hppsga83/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Enumerates connected drives
Unpacked files
SH256 hash:
68b218fd7fff25d1e49a2ae9d087bb323e09b0e04770ab518dddad89a454d520
MD5 hash:
0c201153115c57ee4dd12fed94825984
SHA1 hash:
48d88ca467667831cc43021a1f737c81f930ddb5
Link:
https://www.unpac.me/results/9d8d7251-bf47-48e9-9672-7e0b458913cc/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/68b218fd7fff/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farfli
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/68b218fd7fff25d1e49a2ae9d087bb323e09b0e04770ab518dddad89a454d520

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_DriveSize
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:maldoc_find_kernel32_base_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:maldoc_getEIP_method_1
Create hunting rule
Author:Didier Stevens (https://DidierStevens.com)
Rule name:malware_shellcode_hash
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect shellcode api hash value
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:meth_get_eip
Create hunting rule
Author:Willi Ballenthin
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:Windows_Trojan_DustyWarehouse_a6cfc9f7
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/460869/

Comments