MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7b63ddaf3b217f9e7b08575ee6f80fff1d2d9e12522d862ccc192ef3d08a0dd3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gh0stRAT


Vendor detections: 9


Intelligence 9 IOCs YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7b63ddaf3b217f9e7b08575ee6f80fff1d2d9e12522d862ccc192ef3d08a0dd3
SHA3-384 hash: ff67419ed6fcf07e0c0c6eee88b9e24d4213eb85c854c9e95b77821270e610cb7715e7a463a5014ecebf3601bbdf3b64
SHA1 hash: 4944dbf320a5cdbb1bb39036928930491f4b51cf
MD5 hash: 3a6c44540d1a164f8ec0f8fb3df901f9
humanhash: monkey-mountain-jersey-mirror
File name:fiv_EYYtalk_x64_win_Installer.exe
Download: download sample
Signature Gh0stRAT
Create hunting rule
File size:70'412'122 bytes
First seen:2026-07-05 14:46:11 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash efd455830ba918de67076b7c65d86586 (94 x Gh0stRAT, 22 x ValleyRAT, 6 x OffLoader)
ssdeep 1572864:LEvENWhDirT9CKD2KdDiR8Q9VFEcCM1pF/uE:QmvFg8Q9bEfM1z
Threatray 1'175 similar samples on MalwareBazaar
TLSH T162F7331BB28B563FE12A5D395D73D622493B7E20A9228C5947B8389CCF350D02D3F65B
TrID 61.4% (.EXE) Inno Setup installer (107240/4/30)
23.8% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
3.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.7% (.EXE) Win64 Executable (generic) (6522/11/2)
2.5% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon 0c0f2b69712b0f0c (1 x Gh0stRAT)
Reporter Ling
Tags:exe Gh0stRAT SilverFox ValleyRAT


Avatar
CNGaoLing
SilverFox
IOC (IP 38.46.10.90:443)

Intelligence

File Origin
# of uploads :
1
# of downloads :
138
Origin country :
US US
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/cd123f1e-d93d-4e98-b7c0-1d8377e59769/
Malware family:
n/a
ID:
1
File name:
_7b63ddaf3b217f9e7b08575ee6f80fff1d2d9e12522d862ccc192ef3d08a0dd3.exe
Verdict:
No threats detected
Analysis date:
2026-07-05 14:50:21 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/8828fbf6-5ac4-4681-86b0-4e9d1906c2ba

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Clean
Score:
89.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a4a6e5c762b0b26f3d03905
Tags:
n/a
Result
Verdict:
Clean
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Creating a window
Creating a process from a recently created file
Сreating synchronization primitives
Searching for synchronization primitives
Deleting a recently created file
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
adaptive-context embarcadero_delphi fingerprint inno installer installer installer-heuristic packed reconnaissance
Link:
https://www.filescan.io/uploads/6a4a6e4f40ffe54b8d82c4d7/reports/edfd20ad-bec4-43fa-99c5-fce30fab6735/overview
Verdict:
Malicious
Labled as:
Trojan.Convagent.gen
Link:
https://www.hybrid-analysis.com/sample/7b63ddaf3b217f9e7b08575ee6f80fff1d2d9e12522d862ccc192ef3d08a0dd3
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-07-05T06:10:00Z UTC
Last seen:
2026-07-05T10:31:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/7b63ddaf3b217f9e7b08575ee6f80fff1d2d9e12522d862ccc192ef3d08a0dd3/results?tab=lookup
Score:
93%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/7b63ddaf3b217f9e7b08575ee6f80fff1d2d9e12522d862ccc192ef3d08a0dd3
Gathering data
Verdict:
Malicious
Threat:
Trojan.Win32.Silverfox
Link:
https://tip.neiki.dev/file/7b63ddaf3b217f9e7b08575ee6f80fff1d2d9e12522d862ccc192ef3d08a0dd3
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pnr53lz3ef7z46yik5pon6ap74os3hqskiwymlgmdexphuekbxjq._file
Verdict:
suspicious
Label(s):
shellcode_loader_008
Create hunting rule
Similar samples:
03dae377cafa8389680e1e2ce23491859e947a951b27566310bc37dd669fe194
Gh0stRAT
1d8a948214daf64f3b0b9b894ee8b18dbf9164e54238d8ef88f9372cd03ce3ce
Gh0stRAT
27d4b34d2ea281766a07da52b6700b196bcba749aaf73c96b0320512479e55b8
Gh0stRAT
6d21ee2bece595eaec2814ee8c475dc278b37476645251fe5ee9d309bc58bade
Gh0stRAT
aba9585e07ed0313fecc0678db78ece271e63c773f9d3695f36f36d565ba3b38
Gh0stRAT
af71d8886f256bf2393b1bf6d44b2fcb50d7d546e49bb7b6fbe151a3cf2032f5
Gh0stRAT
c98ac997e2f9def83ee2dc5c7e84e004423aa35f74c96058141e41cffa9db1cd
Gh0stRAT
ca70bc178c645aa50bb22b4845b552fedeea69d4023922cfbc57d79ce27b31d4
Gh0stRAT
error
Gh0stRAT
fdaabbf7b7585cc473502c21a1471f95de45d5492216e8e6c035e1856d6af9b1
Gh0stRAT
+ 1'165 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery installer
Link:
https://tria.ge/reports/260705-r5mbrsgw9n/
Behaviour
Suspicious use of WriteProcessMemory
Inno Setup is an open-source installation builder for Windows applications.
System Location Discovery: System Language Discovery
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gh0stRAT

Executable exe 7b63ddaf3b217f9e7b08575ee6f80fff1d2d9e12522d862ccc192ef3d08a0dd3

(this sample)

  
Delivery method
Distributed via web download

Comments