MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6c36f537ce6cad4fc9ba7114286d295dd7756a593703ab01d1eb15b68219ba58. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Zegost

Vendor detections: 6

Intelligence 6 IOCs YARA 3 File information Comments

SHA256 hash:	6c36f537ce6cad4fc9ba7114286d295dd7756a593703ab01d1eb15b68219ba58
SHA3-384 hash:	91f7a357c02f2690edb87a1ce4e77dc1f5c58218d3329d3f4679a45b0b78ca509e075cc91541f088e2d57e5966cf969c
SHA1 hash:	b986310cc8c72938f2b23a7665f16983809f21c7
MD5 hash:	6e9d5145a5348c57af6ff82df4e523d2
humanhash:	table-coffee-avocado-timing
File name:	87PK772R.bat
Download:	download sample
Signature	Zegost Create hunting rule
File size:	1'341 bytes
First seen:	2022-12-16 13:37:29 UTC
Last seen:	Never
File type:	bat
MIME type:	text/plain
ssdeep	24:7xXOowJlURzRghCqhJoV7ccV3M/9um1B+Vl9RZLDltUgX6LH9:pOoklUR1gwq7oV7n+lfn+JL/ltUgX8
TLSH	T10421EEB27453F247DAB01815887E3701770EF9177D945D4AA2B4B8E4F8C2486AA183DD
Reporter	iamdeadlyz
Tags:	23-106-215-217 bat FakeGaliXCity Gh0stRAT SpaceCity

Iamdeadlyz

From spacecity.games (impersonation of galixcity.io)
Gh0stRAT C&C: 23.106.215.217:1017

Intelligence

File Origin

# of uploads :

# of downloads :

109

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

LauncherV2.exe

Verdict:

Malicious activity

Analysis date:

2022-12-16 13:35:21 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/a1a8a090-2eaf-4f92-b777-0c6d9878ebf9

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/347000/

Result

Verdict:

Clean

Maliciousness:

Behaviour

Searching for the window

Sending a custom TCP request

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-debug evasive explorer.exe greyware keylogger packed shell32.dll

Link:

https://www.filescan.io/uploads/639c74bbea174a8bc6052d73/reports/e0034713-ebf1-4fa0-868f-2c458705aca2/overview

Result

Verdict:

UNKNOWN

Result

Threat name:

Unknown

Detection:

malicious

Classification:

evad

Score:

52 / 100

Link:

https://www.joesandbox.com/analysis/1135717

Signature

Malicious sample detected (through community Yara rule)

Yara detected Obfuscated Powershell

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6c36f537ce6cad4fc9ba7114286d295dd7756a593703ab01d1eb15b68219ba58/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nq3pkn6onswu7sn2oekcq3jjlxlxk2szg4b2waor5mk3naqzxjma._file

Verdict:

unknown

Result

Malware family:

n/a

Score:

1/10

Tags:

n/a

Link:

https://tria.ge/reports/221216-qxc8fshf2v/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/6c36f537ce6cad4fc9ba7114286d295dd7756a593703ab01d1eb15b68219ba58

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Disable_Defender Create hunting rule
Author:	iam-py-test
Description:	Detect files disabling or modifying Windows Defender, Windows Firewall, or Microsoft Smartscreen

Rule name:	SUSP_PowerShell_Caret_Obfuscation_2 Create hunting rule
Author:	Florian Roth
Description:	Detects powershell keyword obfuscated with carets
Reference:	Internal Research

Rule name:	SUSP_PowerShell_Caret_Obfuscation_2_RID347B Create hunting rule
Author:	Florian Roth
Description:	Detects powershell keyword obfuscated with carets
Reference:	Internal Research