MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 79d6a135ee1da05b9e4f690db1afca7d4a96bc85b9e4dc51f68587f3823c30dd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gh0stRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 79d6a135ee1da05b9e4f690db1afca7d4a96bc85b9e4dc51f68587f3823c30dd
SHA3-384 hash: 2222ea2c82ab30671b2b9f3aaf74c71e5fd797a6973e2ed9ee2fbde9c88838725a4ff47baca1cb53e59c925bdd09ccb9
SHA1 hash: ab668f7c73adae6b2d02929b065750c4925da8b9
MD5 hash: faf39e67e83e4e06b98edf249b9135a3
humanhash: diet-burger-double-glucose
File name:79d6a135ee1da05b9e4f690db1afca7d4a96bc85b9e4dc51f68587f3823c30dd
Download: download sample
Signature Gh0stRAT
Create hunting rule
File size:5'530'624 bytes
First seen:2023-12-09 21:10:16 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 8f158a2d6bc3278e1c81011eca942098 (1 x Gh0stRAT)
ssdeep 98304:+QXuF+GoO+PkTKMjk9aVxzfFR19T9FQBAL:0F+GZW9aTfj
TLSH T199466B5A7BB880E4D17AC13DCA069A0BE2F278150B3587CF11A5475E9F3B6E14D3E722
TrID 48.7% (.EXE) Win64 Executable (generic) (10523/12/4)
23.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
9.3% (.EXE) OS/2 Executable (generic) (2029/13)
9.2% (.EXE) Generic Win/DOS Executable (2002/3)
9.2% (.EXE) DOS Executable Generic (2000/1)
File icon (PE):PE icon
dhash icon 70f8f8b6b6f4f439 (1 x Gh0stRAT)
Reporter Xev
Tags:exe Gh0stRAT


Avatar
NIXLovesCooper
C2: new.gettimi.top
C2: book.cookielive.top

Intelligence

File Origin
# of uploads :
1
# of downloads :
313
Origin country :
GR GR
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/464067/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file
DNS request
Sending a custom TCP request
Delayed reading of the file
Сreating synchronization primitives
Creating a process from a recently created file
Creating a process with a hidden window
Enabling autorun by creating a file
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
control crypto explorer greyware hook keylogger lolbin remote shell32
Link:
https://www.filescan.io/uploads/6574d7e718cffa73b1e05261/reports/d6450543-de69-4e67-a5a1-faa957ac1a78/overview
Verdict:
Suspicious
Labled as:
HVM:TrojanDownloader/Maloader.e
Link:
https://www.hybrid-analysis.com/sample/79d6a135ee1da05b9e4f690db1afca7d4a96bc85b9e4dc51f68587f3823c30dd
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/3d7240fd-bfac-4f67-a9e2-50bd864818f2
Result
Threat name:
GhostRat, Nitol
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1356902
Signature
Antivirus detection for URL or domain
Connects to a pastebin service (likely for C&C)
Contains functionality to infect the boot sector
Contains functionality to modify clipboard data
Detected unpacking (creates a PE file in dynamic memory)
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Tries to delay execution (extensive OutputDebugStringW loop)
Yara detected GhostRat
Yara detected Nitol
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1356902 Sample: #U53f0#U6e7e#Uff1a#U62db#U8... Startdate: 09/12/2023 Architecture: WINDOWS Score: 100 25 pastebin.com 2->25 27 book.cookielive.top 2->27 29 5 other IPs or domains 2->29 39 Malicious sample detected (through community Yara rule) 2->39 41 Antivirus detection for URL or domain 2->41 43 Multi AV Scanner detection for dropped file 2->43 47 2 other signatures 2->47 7 #U53f0#U6e7e#Uff1a#U62db#U8058#U8bdd#U672fv.exe 17 2->7         started        11 tapisrv.exe 2->11         started        signatures3 45 Connects to a pastebin service (likely for C&C) 25->45 process4 dnsIp5 31 dlink.host 104.21.85.44, 443, 49729 CLOUDFLARENETUS United States 7->31 17 C:\Users\Public\McAfee\tapisrv.exe, PE32 7->17 dropped 19 C:\Users\Public\McAfee\zlib.dll, PE32 7->19 dropped 21 C:\Users\Public\McAfee\ssleay32.dll, PE32 7->21 dropped 23 6 other files (none is malicious) 7->23 dropped 13 tapisrv.exe 1 1 7->13         started        file6 process7 dnsIp8 33 bbs.cookielive.top.w.kunlunhuf.com 47.246.24.82, 1688, 49732, 49733 TAOBAOZhejiangTaobaoNetworkCoLtdCN United States 13->33 35 pastebin.com 104.20.67.143, 443, 49731 CLOUDFLARENETUS United States 13->35 37 new.gettimi.top 143.92.40.173, 49734, 6108 BCPL-SGBGPNETGlobalASNSG Singapore 13->37 49 Detected unpacking (creates a PE file in dynamic memory) 13->49 51 Contains functionality to infect the boot sector 13->51 53 Contains functionality to modify clipboard data 13->53 55 Tries to delay execution (extensive OutputDebugStringW loop) 13->55 signatures9
Score:
67%
Verdict:
Susipicious
File Type:
PE
Link:
https://malprob.io/report/79d6a135ee1da05b9e4f690db1afca7d4a96bc85b9e4dc51f68587f3823c30dd
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/79d6a135ee1da05b9e4f690db1afca7d4a96bc85b9e4dc51f68587f3823c30dd/
Threat name:
Win64.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2023-12-09 15:46:20 UTC
File Type:
PE+ (Exe)
Extracted files:
11
AV detection:
8 of 23 (34.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=phlkcnpodwqfxhspneg3dl6kpvfjnpefxhsnyupwqwd7har4gdoq._file
Verdict:
unknown
Result
Malware family:
gh0strat
Create hunting rule
Score:
  10/10
Tags:
family:gh0strat rat
Link:
https://tria.ge/reports/231209-z1kw5saedj/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Enumerates connected drives
Legitimate hosting services abused for malware hosting/C2
Checks computer location settings
Executes dropped EXE
Loads dropped DLL
Gh0st RAT payload
Gh0strat
Unpacked files
SH256 hash:
79d6a135ee1da05b9e4f690db1afca7d4a96bc85b9e4dc51f68587f3823c30dd
MD5 hash:
faf39e67e83e4e06b98edf249b9135a3
SHA1 hash:
ab668f7c73adae6b2d02929b065750c4925da8b9
Link:
https://www.unpac.me/results/a3dc8837-c795-45d7-a3e3-b9ab9761a92d/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/79d6a135ee1da05b9e4f690db1afca7d4a96bc85b9e4dc51f68587f3823c30dd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Armadillov1xxv2xx
Create hunting rule
Author:malware-lu
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:MALWARE_Win_Zegost
Create hunting rule
Author:ditekSHen
Description:Detects Zegost
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/464067/

Comments