MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 852e7a60a7f28a19c2119ebb40678944ed59a5d7ae0139d3d420220e414ae2c7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Nitol
Vendor detections: 11
| SHA256 hash: | 852e7a60a7f28a19c2119ebb40678944ed59a5d7ae0139d3d420220e414ae2c7 |
|---|---|
| SHA3-384 hash: | b03df85de79906b8bc8fcf9096a01c63b1d1557ff0fd32e7a9ca8a73691def7a8e5edc405da46a1a047462dffdc63c44 |
| SHA1 hash: | 1dc0eac3c1cd27a38bba192a9aa55c9e19538234 |
| MD5 hash: | 168be574289b2297596b87f6e157afd9 |
| humanhash: | lemon-burger-march-winner |
| File name: | Server.exe |
| Download: | download sample |
| Signature | Nitol |
| File size: | 1'708'432 bytes |
| First seen: | 2022-09-30 23:48:33 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | baa93d47220682c04d92f7797d9224ce (139 x RiseProStealer, 26 x Xtrat, 18 x CoinMiner) |
| ssdeep | 49152:iD4VHA/u/NbcxiDOO7cd5rpYrOCIZ91PYTkc:w/uWIDZ7OFk |
| Threatray | 14'714 similar samples on MalwareBazaar |
| TLSH | T10E8533EB89A13676E4D3CE390E32FA126F7731BBE80819C52D4B9C24FD27D119167198 |
| TrID | 29.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 22.7% (.EXE) Win16 NE executable (generic) (5038/12/1) 20.3% (.EXE) Win32 Executable (generic) (4505/5/1) 9.1% (.EXE) OS/2 Executable (generic) (2029/13) 9.0% (.EXE) Generic Win/DOS Executable (2002/3) |
| Reporter |  r3dbU7z |
| Tags: | exe Nitol RAT |
Intelligence
File Origin
# of uploads :
1
# of downloads :
338
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Result
Verdict:
Malware
Maliciousness:
Behaviour
Сreating synchronization primitives
Searching for analyzing tools
Searching for the window
Sending a custom TCP request
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
overlay packed
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Malicious
Result
Threat name:
GhostRat, Nitol
Detection:
malicious
Classification:
bank.troj.spyw.evad
Score:
100 / 100
Signature
Antivirus / Scanner detection for submitted sample
Checks if browser processes are running
Contains functionality to capture and log keystrokes
Detected unpacking (changes PE section rights)
Found stalling execution ending in API Sleep call
Hides threads from debuggers
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
PE file contains section with special chars
Snort IDS alert for network traffic
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Yara detected GhostRat
Yara detected Nitol
Behaviour
Behavior Graph:
Threat name:
Win32.Backdoor.Farfli
Status:
Malicious
First seen:
2022-09-30 23:49:10 UTC
File Type:
PE (Exe)
AV detection:
21 of 26 (80.77%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
+ 14'704 additional samples on MalwareBazaar
Result
Malware family:
gh0strat
Score:
10/10
Tags:
family:gh0strat evasion rat
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of NtSetInformationThreadHideFromDebugger
Enumerates connected drives
Checks BIOS information in registry
Identifies Wine through registry keys
Identifies VirtualBox via ACPI registry values (likely anti-VM)
Gh0st RAT payload
Gh0strat
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
980396b61e1147bbbbaaa677e9d7e7579e60dd35a1527bbabd1b2218798c7353
MD5 hash:
487090232d02218d13c659316d0fefb6
SHA1 hash:
9d99175438a8ef2cdffe628d0ee9c29b01b2b9ff
SH256 hash:
852e7a60a7f28a19c2119ebb40678944ed59a5d7ae0139d3d420220e414ae2c7
MD5 hash:
168be574289b2297596b87f6e157afd9
SHA1 hash:
1dc0eac3c1cd27a38bba192a9aa55c9e19538234
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.