MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 877ae9b05c73f62202bb0f6212340f87a204d85966f9c2485f504b17e72ae8a5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gh0stRAT

Vendor detections: 16

Intelligence 16 IOCs 1 YARA 7 File information Comments

SHA256 hash:	877ae9b05c73f62202bb0f6212340f87a204d85966f9c2485f504b17e72ae8a5
SHA3-384 hash:	4da05853b871cb563e31e0f05eb5748758b34d55e6dd12490db80a697ad44ee8b2e28d59770462ad3b75c0e0c8a47dcc
SHA1 hash:	12be725938b31a77a47a7e19ad8124783b019764
MD5 hash:	0960b57d257d6c76d84cf9d54577a7ba
humanhash:	hotel-lion-delta-stairway
File name:	0960b57d257d6c76d84cf9d54577a7ba.exe
Download:	download sample
Signature	Gh0stRAT Create hunting rule
File size:	99'840 bytes
First seen:	2025-08-04 19:55:15 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	df07a00324c67713a82c396040064c47 (1 x Gh0stRAT)
ssdeep	1536:ohDhKT2BUW5Umt8a53QmB4efDJlDoG0yJ9vUiT9I7pwfQex54:Y1UW5Umt8o3QmB4e7fDoG0a1TuwJ4
TLSH	T124A3C00279F2C4B6DD9731310B62F62EDE3B14AF5210A45F6B905C2A1C236E1BC5DEB2
TrID	40.3% (.EXE) Win64 Executable (generic) (10522/11/4) 19.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 17.2% (.EXE) Win32 Executable (generic) (4504/4/1) 7.7% (.EXE) OS/2 Executable (generic) (2029/13) 7.6% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
dhash icon	c9d4c4cda6a8cec6 (5 x Gh0stRAT, 2 x FatalRAT, 2 x Formbook)
Reporter	abuse_ch
Tags:	exe Gh0stRAT RAT

abuse_ch

Gh0stRAT C2:
52.4.202.45:80

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
52.4.202.45:80	https://threatfox.abuse.ch/ioc/1564288/

Intelligence

File Origin

# of uploads :

# of downloads :

217

Origin country :

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

0960b57d257d6c76d84cf9d54577a7ba.exe

Verdict:

Malicious activity

Analysis date:

2025-08-04 19:55:47 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/a8096940-00f6-4176-9f6a-f9448cdda33c

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/18893/

Detection(s):

Win.Trojan.Hydraq-149

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68911039af3050dc8d3459ab

Tags:

backdoor virus madi sage

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the Program Files subdirectories

Running batch commands

Creating a process with a hidden window

Creating a process from a recently created file

Сreating synchronization primitives

Creating a file in the Windows directory

Launching a process

Searching for synchronization primitives

Sending a custom TCP request

Launching the default Windows debugger (dwwin.exe)

DNS request

Connection attempt

Creating a file in the Windows subdirectories

Enabling autorun

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

andromeda cmd evasive farfli hydraq lolbin microsoft_visual_cc moudoor obfuscated packed packed packer_detected

Link:

https://www.filescan.io/uploads/6891103473b8ef6f4afe8efe/reports/18fa5ea3-08a3-42c4-9fa3-2d582088d2c0/overview

Verdict:

Malicious

Labled as:

Andromeda.Generic

Link:

https://www.hybrid-analysis.com/sample/877ae9b05c73f62202bb0f6212340f87a204d85966f9c2485f504b17e72ae8a5

Malware family:

Ploutus-D

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/625aaae7-406e-4597-8ca8-4cdf02564230

Result

Threat name:

n/a

Detection:

malicious

Classification:

troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1750102

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Contains functionality to access PhysicalDrive, possible boot sector overwrite

Contains functionality to detect sleep reduction / modifications

Contains functionality to infect the boot sector

Creates an undocumented autostart registry key

Found evasive API chain (may stop execution after checking mutex)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Self deletion via cmd or bat file

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Behaviour

Behavior Graph:

Download SVG

Score:

98%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/877ae9b05c73f62202bb0f6212340f87a204d85966f9c2485f504b17e72ae8a5

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) Win 32 Exe x86

Link:

https://app.malva.re/file/0960b57d257d6c76d84cf9d54577a7ba

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/877ae9b05c73f62202bb0f6212340f87a204d85966f9c2485f504b17e72ae8a5/

Verdict:

Malicious

Threat:

Backdoor.Win32.TCP

Link:

https://tip.neiki.dev/file/877ae9b05c73f62202bb0f6212340f87a204d85966f9c2485f504b17e72ae8a5

Threat name:

Win32.Backdoor.Moudoor

Status:

Malicious

First seen:

2025-08-02 05:53:39 UTC

AV detection:

32 of 38 (84.21%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=q55otmc4op3ceav3b5rbenapq6rajwczm344esc7kbfrpzzk5csq._file

Verdict:

malicious

Label(s):

paladin

Similar samples:

error

Gh0stRAT

Result

Malware family:

gh0strat

Score:

10/10

Tags:

family:gh0strat discovery persistence rat

Link:

https://tria.ge/reports/250804-yncvbst1az/

Behaviour

Checks processor information in registry

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

Program crash

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

Drops file in Program Files directory

Drops file in Windows directory

Drops file in System32 directory

Executes dropped EXE

Loads dropped DLL

Adds policy Run key to start application

Gh0st RAT payload

Gh0strat

Gh0strat family

Verdict:

Malicious

Tags:

Win.Trojan.Hydraq-149 PCRAT Gh0st RAT

YARA:

n/a

Link:

https://app.threat.zone/submission/e324ea61-f80c-48cb-aef9-54d73b849b1c

Unpacked files

SH256 hash:

877ae9b05c73f62202bb0f6212340f87a204d85966f9c2485f504b17e72ae8a5

MD5 hash:

0960b57d257d6c76d84cf9d54577a7ba

SHA1 hash:

12be725938b31a77a47a7e19ad8124783b019764

Link:

https://www.unpac.me/results/ba06f994-840c-4208-8721-cc6d9eee64b1/

SH256 hash:

6eb5cb66f2ab6449b1f4f43db98a9b3e0f447204ef6a3ecb5815b936d3a6e87c

MD5 hash:

5dcb78d65d598412e5f581dcd0a12601

SHA1 hash:

422095f4c238e4ad76b27b20dca881559e20dd2c

Link:

https://www.unpac.me/results/ba06f994-840c-4208-8721-cc6d9eee64b1/

SH256 hash:

1f767367cef43a6124649b3149a0b7722f421021026b1714d34fde078c868b2f

MD5 hash:

1758793b1f53d382c60c4f010552f9d9

SHA1 hash:

51e47002edc2c1224796a3ef9ee49c03f1affa61

Link:

https://www.unpac.me/results/ba06f994-840c-4208-8721-cc6d9eee64b1/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/877ae9b05c73f62202bb0f6212340f87a204d85966f9c2485f504b17e72ae8a5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Armadillov1xxv2xx Create hunting rule
Author:	malware-lu

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	CMD_Ping_Localhost Create hunting rule

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	malware_shellcode_hash Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect shellcode api hash value

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/18893/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_NX	Missing Non-Executable Memory Protection	critical
CHECK_PIE	Missing Position-Independent Executable (PIE) Protection	high

Reviews

ID	Capabilities	Evidence
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryA KERNEL32.dll::GetStartupInfoA KERNEL32.dll::GetCommandLineA
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CopyFileA KERNEL32.dll::GetWindowsDirectoryA
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegCreateKeyA ADVAPI32.dll::RegCreateKeyExA ADVAPI32.dll::RegDeleteKeyA ADVAPI32.dll::RegSetValueExA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample