🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 850d135d3ff871f88c96e5a6b889b1f454944ffdd35b2fce5e3fa1d049d8bf70. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gh0stRAT


Vendor detections: 11


Intelligence 11 IOCs YARA 11 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 850d135d3ff871f88c96e5a6b889b1f454944ffdd35b2fce5e3fa1d049d8bf70
SHA3-384 hash: 19b45602a67f62afefe40f898d9c5f2c16eed1e2d22b44efeff565c20cba40bb402fbd3a7a16d46c9aa0cba72e7db5fb
SHA1 hash: c54a5a679129dc4618e49e5d4f7fc8c1feb007df
MD5 hash: fd94699028705bed62451d7f49f491ab
humanhash: mexico-crazy-bulldog-foxtrot
File name:quark-windows-64243.exe
Download: download sample
Signature Gh0stRAT
Create hunting rule
File size:5'430'309 bytes
First seen:2026-10-27 23:46:21 UTC
Last seen:2026-10-28 00:34:09 UTC
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash efd455830ba918de67076b7c65d86586 (107 x Gh0stRAT, 23 x ValleyRAT, 6 x OffLoader)
ssdeep 98304:k5fgQvyQMUtet/DqFScvEhMu/D+PvP7A7dbWfNR7hkbvMzj:8bvyQreJq7EZyP78gflMMzj
TLSH T1D7461227B2CB653FF07A4A3A4A72E112593B7A61A9134C679BF4185CCF260D01E3F746
TrID 61.4% (.EXE) Inno Setup installer (107240/4/30)
23.8% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
3.7% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
3.7% (.EXE) Win64 Executable (generic) (6522/11/2)
2.5% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon ccaaa2a2b2aaa29a (1 x Gh0stRAT)
Reporter Ling
Tags:Cybercrime exe Gh0stRAT SilverFox ValleyRAT


Avatar
CNGaoLing
SilverFox / Cybercrime
IOC (Domain rfjp93sina.top) (IP 143.92.35.33:443)

Intelligence

File Origin
# of uploads :
2
# of downloads :
195
Origin country :
FR FR
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/e00ba1c5-2ad3-4278-b0d3-f0bad52648d0/
Malware family:
n/a
ID:
1
File name:
quark-windows-64243.exe
Verdict:
Malicious activity
Analysis date:
2026-10-27 23:24:00 UTC
Tags:
installer
Link:
https://app.any.run/tasks/e94148ed-703e-4de5-8240-cf7be12c8dbd

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/95553/
Detection(s):
SecuriteInfo.com.Win32.Malware-gen.41589919.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae1380549621540087bfd5c
Tags:
dropper obfusc virus
Verdict:
Malicious
Labled as:
Trojan.Convagent.gen
Link:
https://www.hybrid-analysis.com/sample/850d135d3ff871f88c96e5a6b889b1f454944ffdd35b2fce5e3fa1d049d8bf70
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-10-27T09:04:00Z UTC
Last seen:
2026-10-28T18:35:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan.Win32.Silverfox.gen HEUR:Trojan.Win32.Convagent.gen VHO:Trojan.Win32.SilverFox.gen
Link:
https://opentip.kaspersky.com/850d135d3ff871f88c96e5a6b889b1f454944ffdd35b2fce5e3fa1d049d8bf70/results?tab=lookup
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/8fdd8eaa-0710-4316-9480-4e666351ece7
Result
Threat name:
n/a
Detection:
malicious
Classification:
n/a
Score:
72 / 100
Link:
https://www.joesandbox.com/analysis/1993539
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
86%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/850d135d3ff871f88c96e5a6b889b1f454944ffdd35b2fce5e3fa1d049d8bf70
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/fd94699028705bed62451d7f49f491ab
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/850d135d3ff871f88c96e5a6b889b1f454944ffdd35b2fce5e3fa1d049d8bf70/
Threat name:
Win32.Trojan.Convagent
Create hunting rule
Status:
Malicious
First seen:
2026-10-27 14:27:58 UTC
File Type:
PE (Exe)
AV detection:
19 of 38 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qugrgxj77by7rdew4wtlrcnr6rkjit752nns7ts6h6q5asoyx5ya._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery installer
Link:
https://tria.ge/reports/261027-3sy1ksxvgy/
Behaviour
Suspicious use of WriteProcessMemory
Inno Setup is an open-source installation builder for Windows applications.
System Location Discovery: System Language Discovery
Executes dropped EXE
Unpacked files
SH256 hash:
850d135d3ff871f88c96e5a6b889b1f454944ffdd35b2fce5e3fa1d049d8bf70
MD5 hash:
fd94699028705bed62451d7f49f491ab
SHA1 hash:
c54a5a679129dc4618e49e5d4f7fc8c1feb007df
Link:
https://www.unpac.me/results/873da6ad-7a14-4969-9ef9-5575ab395d2e/
SH256 hash:
6d59ed33e5b8e158452018e0749069a12c966336200c9b545ef9e6c0592c395b
MD5 hash:
952568b497d64bad0a47ee8e938296c2
SHA1 hash:
be23cfabf32b871d5cfa81526f92c9728b67c9fd
Link:
https://www.unpac.me/results/873da6ad-7a14-4969-9ef9-5575ab395d2e/
SH256 hash:
388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
MD5 hash:
e4211d6d009757c078a9fac7ff4f03d4
SHA1 hash:
019cd56ba687d39d12d4b13991c9a42ea6ba03da
Link:
https://www.unpac.me/results/873da6ad-7a14-4969-9ef9-5575ab395d2e/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/850d135d3ff871f88c96e5a6b889b1f454944ffdd35b2fce5e3fa1d049d8bf70

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:MULTI_Malware_AgentTesla_ForgeAuto_ed343f78_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects AgentTesla (inconnu, etat extrait)
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:WIN_Malware_Unknown_ForgeAuto_1708427c_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_4ab123d7_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_6422f546_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_f5d58a9e_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gh0stRAT

Executable exe 850d135d3ff871f88c96e5a6b889b1f454944ffdd35b2fce5e3fa1d049d8bf70

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/95553/

Comments