MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 73096690ffc9dad9df868fa94030607f4361bf9cd4e6a0f7e940d8696d758f4c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
RunningRAT
Vendor detections: 14
| SHA256 hash: | 73096690ffc9dad9df868fa94030607f4361bf9cd4e6a0f7e940d8696d758f4c |
|---|---|
| SHA3-384 hash: | 13f7d85f1aedee64c61a85fdb01808a5a74893827e8747e167758549237a25a6b307f6ebd2b5b721d90068bbceb305d7 |
| SHA1 hash: | d92c92fe190de3e2eacbe2c7ca0c379af8e06ec4 |
| MD5 hash: | 2e0699c149b6e8f5052c9ca681b31483 |
| humanhash: | river-bacon-indigo-seventeen |
| File name: | 2e0699c149b6e8f5052c9ca681b31483.exe |
| Download: | download sample |
| Signature | RunningRAT |
| File size: | 33'280 bytes |
| First seen: | 2023-01-16 09:36:21 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 3d2b95b998469ac775106242f347c0e1 (4 x RunningRAT, 4 x CoinMiner) |
| ssdeep | 768:1w/iOWTK3JWhOM/qZh7UJGcZ/VN0BlXGnbcuyD7Urs9:WQK52fqZSIA9olXGnouy8rs9 |
| Threatray | 19'006 similar samples on MalwareBazaar |
| TLSH | T1A2E2D098E2FD6988D3B90A39DD53770D2812E8266686873F6F80312EAD737287C74125 |
| TrID | 52.7% (.EXE) UPX compressed Win32 Executable (27066/9/6) 12.8% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 9.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 8.7% (.EXE) Win32 Executable (generic) (4505/5/1) 4.0% (.ICL) Windows Icons Library (generic) (2059/9) |
| Reporter |  abuse_ch |
| Tags: | exe RunningRAT |
Intelligence
File Origin
# of uploads :
1
# of downloads :
188
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
2e0699c149b6e8f5052c9ca681b31483.exe
Verdict:
Suspicious activity
Analysis date:
2023-01-16 09:49:27 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
RunningRAT
Detection(s):
Result
Verdict:
Malware
Maliciousness:
Behaviour
Searching for the window
Сreating synchronization primitives
Creating a file in the Windows subdirectories
Creating a service
Launching a service
Launching a process
Running batch commands
Creating a process with a hidden window
Creating a process from a recently created file
Creating a window
DNS request
Sending a custom TCP request
Enabling autorun for a service
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
packed
Malware family:
Indexsinas
Verdict:
Malicious
Result
Threat name:
Gh0stCringe
Detection:
malicious
Classification:
bank.troj.evad
Score:
100 / 100
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Checks if browser processes are running
Creates a Windows Service pointing to an executable in C:\Windows
DLL side loading technique detected
Drops executables to the windows directory (C:\Windows) and starts them
Found evasive API chain (may stop execution after checking mutex)
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Self deletion via cmd or bat file
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Yara detected Gh0stCringe
Behaviour
Behavior Graph:
Threat name:
Win32.Trojan.Siscos
Status:
Malicious
First seen:
2023-01-15 18:57:03 UTC
File Type:
PE (Exe)
Extracted files:
7
AV detection:
23 of 26 (88.46%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 18'996 additional samples on MalwareBazaar
Result
Malware family:
runningrat
Score:
10/10
Tags:
family:gh0strat family:runningrat persistence rat upx
Behaviour
Checks processor information in registry
Modifies data under HKEY_USERS
Runs ping.exe
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Creates a Windows Service
Drops file in System32 directory
Checks computer location settings
Deletes itself
Loads dropped DLL
Executes dropped EXE
Sets DLL path for service in the registry
UPX packed file
Gh0st RAT payload
Gh0strat
RunningRat
RunningRat payload
Unpacked files
SH256 hash:
7faf403b9748cdc9b8f8aba98a64567fcd9c5ad490bcc31a0b6cce978003e754
MD5 hash:
67471f9e74ce07e6de4be37cd6fadf51
SHA1 hash:
57cf550e19df2e8c04a71e712be4dcf58a17faef
Detections:
win_younglotus_g0
SH256 hash:
74d6079437e6a67a8afe00f07b64286e16b52d1523d6a8684a2fa74e9e9e7e7d
MD5 hash:
8684aace2cdf6cdda84e2ac34d41b1e4
SHA1 hash:
d2d0c57dcb9650c1b928c6f4c920dba44b9f5d64
Detections:
win_runningrat_w0
SH256 hash:
73096690ffc9dad9df868fa94030607f4361bf9cd4e6a0f7e940d8696d758f4c
MD5 hash:
2e0699c149b6e8f5052c9ca681b31483
SHA1 hash:
d92c92fe190de3e2eacbe2c7ca0c379af8e06ec4
Malware family:
ZxShell
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.