MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 83fbbd31e43ad25a8921c98d97b287ebc8902451f7647c2266e5f0688471e8b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Gh0stRAT
Vendor detections: 10
| SHA256 hash: | 83fbbd31e43ad25a8921c98d97b287ebc8902451f7647c2266e5f0688471e8b6 |
|---|---|
| SHA3-384 hash: | f8b0c3adf78be0249510afd59014d3a3d211c31723030a3c810c6ff92ae6d3bb551959ef3f9d16b0b196e3cc519010d1 |
| SHA1 hash: | 692cb886cfae78532f7cd07465d4a95032613535 |
| MD5 hash: | 37900245e5856d53be7737a5adf5ac8d |
| humanhash: | ohio-orange-timing-pizza |
| File name: | 37900245E5856D53BE7737A5ADF5AC8D.exe |
| Download: | download sample |
| Signature | Gh0stRAT |
| File size: | 713'128 bytes |
| First seen: | 2021-08-22 20:16:18 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 0f87eef679691562a6afad06bf1aae21 (1 x Gh0stRAT) |
| ssdeep | 12288:4v1EY7o5XC9FqGDbsRwj9VP1THHk8S18F6OnuDw9l:017uXCPqYsRwj9/bHkFS9l |
| Threatray | 5 similar samples on MalwareBazaar |
| TLSH | T191E4841E373640B1C494DCF27C2E3351BADD8D51E62EC7715861BA68A0BBAF16A52CCC |
| dhash icon | b269d4b2d4cc699e (1 x Gh0stRAT) |
| Reporter |  abuse_ch |
| Tags: | exe Gh0stRAT |
Indicators Of Compromise (IOCs)
Below is a list of indicators of compromise (IOCs) associated with this malware samples.
| IOC | ThreatFox Reference |
|---|---|
| 103.46.128.46:26098 | https://threatfox.abuse.ch/ioc/192630/ |
Intelligence
File Origin
# of uploads :
1
# of downloads :
172
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
37900245E5856D53BE7737A5ADF5AC8D.exe
Verdict:
No threats detected
Analysis date:
2021-08-22 20:17:29 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a service
Creating a file in the Windows subdirectories
Launching a service
Sending a UDP request
Sending a custom TCP request
DNS request
Enabling autorun for a service
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Gh0st RAT
Verdict:
Malicious
Result
Threat name:
GhostRat
Detection:
malicious
Classification:
bank.troj.evad
Score:
100 / 100
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Changes security center settings (notifications, updates, antivirus, firewall)
Checks if browser processes are running
Connects to many ports of the same IP (likely port scanning)
Contains functionality to detect sleep reduction / modifications
Contains functionality to inject threads in other processes
Creates a Windows Service pointing to an executable in C:\Windows
Deletes itself after installation
DLL side loading technique detected
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
May modify the system service descriptor table (often done to hook functions)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Yara detected GhostRat
Behaviour
Behavior Graph:
Threat name:
Win32.Backdoor.PcClient
Status:
Malicious
First seen:
2021-08-20 02:18:00 UTC
AV detection:
26 of 28 (92.86%)
Threat level:
5/5
Detection(s):
Malicious file
Verdict:
malicious
Similar samples:
Result
Malware family:
n/a
Score:
8/10
Tags:
aspackv2 persistence
Behaviour
Checks processor information in registry
Modifies data under HKEY_USERS
Drops file in System32 directory
Deletes itself
Loads dropped DLL
Sets DLL path for service in the registry
Unpacked files
SH256 hash:
30c860f2092ff4af38dac98e774afe2e5414f74d3daa0fd894d92d38fc096035
MD5 hash:
dde4ea73252a6b9ea9954b4358ca3a62
SHA1 hash:
7b74683027df777cc1b34fc787d504199b67c136
SH256 hash:
43fe5fe82c50454e0c05aed4c8b434d6d53e81208e13f49249f6ed093d4e7508
MD5 hash:
4ff4a06f2bc8a6d41e7d81a7c93868f9
SHA1 hash:
6a6c6c8bd99aeb21489111b1eb462c213ecfe286
SH256 hash:
e543896f360e1442c6e91cf6a9292bdfe91dc43e4b934f36e0b817e14d98d6d2
MD5 hash:
6c31770cd8b9395b4ab46e18f41df9dd
SHA1 hash:
7e587772e689e3dd79ffd04986523a9dd041a0b0
SH256 hash:
83fbbd31e43ad25a8921c98d97b287ebc8902451f7647c2266e5f0688471e8b6
MD5 hash:
37900245e5856d53be7737a5adf5ac8d
SHA1 hash:
692cb886cfae78532f7cd07465d4a95032613535
Malware family:
Gh0st RAT
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farfli
Score:
0.90
YARA Signatures
MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.
| Rule name: | INDICATOR_EXE_Packed_ASPack |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables packed with ASPack |
| Rule name: | INDICATOR_KB_CERT_0a1f3a057a1dce4bf7d76d0c7adf837e |
|---|---|
| Author: | ditekSHen |
| Description: | Detects executables signed with stolen, revoked or invalid certificates |
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.