MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 8b79dcff7e5007961448d9baeb7fa7ef65c399166b5250c982084b22899466cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Gh0stRAT
Vendor detections: 12
| SHA256 hash: | 8b79dcff7e5007961448d9baeb7fa7ef65c399166b5250c982084b22899466cb |
|---|---|
| SHA3-384 hash: | 3cdd8e47bbe7928c5972c853e19b679e57ad22cc05d4db33902e88d32b618bff0cde5b4ed962a309c27d8f5fc8ef0418 |
| SHA1 hash: | 1655c29315145cbd4622c24f268245490bba069c |
| MD5 hash: | 7448f07e20cc2a5e59ce8de6d88a3241 |
| humanhash: | jupiter-twenty-michigan-georgia |
| File name: | 8B79DCFF7E5007961448D9BAEB7FA7EF65C399166B525.exe |
| Download: | download sample |
| Signature | Gh0stRAT |
| File size: | 134'753 bytes |
| First seen: | 2021-10-03 23:30:41 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 7fa974366048f9c551ef45714595665e (946 x Formbook, 398 x Loki, 261 x AgentTesla) |
| ssdeep | 3072:ALk395hYXJ3kN+4EyCDgPa9tG9Xd28E/vgJ8u:AQqRkN+NyCsi9t2CvgJ8u |
| Threatray | 8 similar samples on MalwareBazaar |
| TLSH | T1CDD3AD9EE0415F1BC232D1BB0ADF9935BCFE43BF8E915B0737652853AB80546B02915B |
| File icon (PE): |  |
| dhash icon | f4f4e6c6e6e6ccdc (18 x Cybergate, 5 x Gh0stRAT, 1 x Blackmoon) |
| Reporter |  abuse_ch |
| Tags: | exe Gh0stRAT |
Indicators Of Compromise (IOCs)
Below is a list of indicators of compromise (IOCs) associated with this malware samples.
| IOC | ThreatFox Reference |
|---|---|
| 104.232.98.28:2222 | https://threatfox.abuse.ch/ioc/230034/ |
Intelligence
File Origin
# of uploads :
1
# of downloads :
164
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
8B79DCFF7E5007961448D9BAEB7FA7EF65C399166B525.exe
Verdict:
No threats detected
Analysis date:
2021-10-03 23:31:34 UTC
Tags:
installer
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
Gh0St
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a file in the Windows subdirectories
Creating a process from a recently created file
Creating a file in the Windows directory
Deleting a system file
Moving a system file
Replacing system executable files
Launching a process
Creating a process with a hidden window
Connection attempt
Enabling the 'hidden' option for recently created files
Creating a window
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Creating a file in the mass storage device
Infecting executable files
Enabling autorun by creating a file
Enabling threat expansion on mass storage devices by creating the autorun.inf autorun file
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
overlay packed
Malware family:
Zegost
Verdict:
Malicious
Result
Threat name:
Unknown
Detection:
malicious
Classification:
spre.spyw.evad
Score:
100 / 100
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Contains functionality to capture and log keystrokes
Contains functionality to detect sleep reduction / modifications
Contains functionality to detect virtual machines (IN, VMware)
Contains functionality to enumerate network shares of other devices
Creates an autostart registry key pointing to binary in C:\Windows
Drops executables to the windows directory (C:\Windows) and starts them
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Infects executable files (exe, dll, sys, html)
Machine Learning detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Threat name:
Win32.Backdoor.Zegost
Status:
Malicious
First seen:
2016-07-08 23:16:00 UTC
AV detection:
25 of 28 (89.29%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Similar samples:
Result
Malware family:
xmrig
Score:
10/10
Tags:
family:xmrig miner persistence
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Windows directory
Drops file in System32 directory
Adds Run key to start application
Enumerates connected drives
Loads dropped DLL
Executes dropped EXE
xmrig
Unpacked files
SH256 hash:
26ae7f3f3393bef628b2e9841e7a6ec490871eb5cea19dc2b2fec4f7f434def3
MD5 hash:
9d0be21602ac20b7afaaacb575d24b99
SHA1 hash:
579f98d738f98859087e5c07bfd86c142bf85cce
SH256 hash:
8b79dcff7e5007961448d9baeb7fa7ef65c399166b5250c982084b22899466cb
MD5 hash:
7448f07e20cc2a5e59ce8de6d88a3241
SHA1 hash:
1655c29315145cbd4622c24f268245490bba069c
Malware family:
Gh0st RAT
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.