MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9e05baee59cd27a85f08cf2fa678f54c3bb639f29d4521bfa0319bf174c04dba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gh0stRAT

Vendor detections: 15

Intelligence 15 IOCs YARA 23 File information Comments

SHA256 hash:	9e05baee59cd27a85f08cf2fa678f54c3bb639f29d4521bfa0319bf174c04dba
SHA3-384 hash:	b02949a61c8fead6b00459f70d6334100f177d8186795bebc93afc51c65a32597863d8bcc32ca6b1c959cb457da02247
SHA1 hash:	b198a045929d3ec21037502049f89170bdbf594d
MD5 hash:	232b67632733d8df1b118d76fd70c1f5
humanhash:	steak-spaghetti-ack-red
File name:	SecuriteInfo.com.FileRepMalware.2704.8196
Download:	download sample
Signature	Gh0stRAT Create hunting rule
File size:	6'112'014 bytes
First seen:	2025-07-03 14:16:29 UTC
Last seen:	2025-07-03 15:21:40 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	efd455830ba918de67076b7c65d86586 (54 x Gh0stRAT, 19 x ValleyRAT, 6 x OffLoader)
ssdeep	98304:OxHXSkvEPcvlVFFK+La+It2/Z896tXoChEsvLd5Km9hyySKGsCl0qv:OSibJFfLaW896txHhyySKGsClVv
TLSH	T1DC561213F2CBA13FF07E49364A76D222953BAA6065128C6A97EC385CCE261D41D3F747
TrID	49.8% (.EXE) Inno Setup installer (107240/4/30) 20.0% (.EXE) InstallShield setup (43053/19/16) 19.3% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9) 4.8% (.EXE) Win64 Executable (generic) (10522/11/4) 2.0% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	5050d270cccc82ae (109 x Adware.Generic, 43 x LummaStealer, 42 x OffLoader)
Reporter	SecuriteInfoCom
Tags:	exe Gh0stRAT

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware family:

meterpreter

ID:

File name:

main.exe

Verdict:

Malicious activity

Analysis date:

2025-07-03 12:48:25 UTC

Tags:

loader python github metasploit backdoor meterpreter payload phishing clickfix networm amus possible-phishing miner remcos rat azorult wannacry ransomware auto generic modiloader masslogger stealer njrat dbatloader purelogs purecrypter bladabindi formbook havoc phorpiex pyinstaller redline metastealer aurotunstealer storm1747 tycoon vidar evasion telegram sage snake keylogger agenttesla screenconnect rmm-tool rdp aurotun lumma quasar coinminer younglotus loki dcrat asyncrat pythonstealer koistealer koiloader koi arechclient2 remote arkeistealer neshta m0yv putty gh0st sality lokibot trojan stealc blankgrabber xloader emmenhtal delphi xred websocket xor-url crypto-regex ims-api iqvw64e-sys vuln-driver winring0x64-sys ghostsocks proxyware smokeloader auto-sch-xml ftp exfiltration gh0stcringe autoit ngrok

Link:

https://app.any.run/tasks/b654798a-cb32-499a-8bf7-4dcd5f4c2e53

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/12163/

Detection(s):

SecuriteInfo.com.FileRepMalware.2704.8196.UNOFFICIAL

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=686690f1900df8e7f86625fb

Tags:

injection autorun dropper smtp

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Creating a window

Creating a process from a recently created file

Сreating synchronization primitives

Searching for synchronization primitives

Creating a file

Creating a file in the %AppData% subdirectories

Using the Windows Management Instrumentation requests

Creating a file in the %AppData% directory

DNS request

Connection attempt

Unauthorized injection to a recently created process by context flags manipulation

Setting a global event handler for the keyboard

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

adaptive-context embarcadero_delphi fingerprint installer overlay overlay packed packed packer_detected

Link:

https://www.filescan.io/uploads/686690fd7423ff017c3ea663/reports/d70f939b-a42c-4e5e-bab3-d02b71470243/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_60%

Link:

https://www.hybrid-analysis.com/sample/9e05baee59cd27a85f08cf2fa678f54c3bb639f29d4521bfa0319bf174c04dba

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/e4846f00-4291-4e90-ac00-64833d9f9bd4

Score:

76%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/9e05baee59cd27a85f08cf2fa678f54c3bb639f29d4521bfa0319bf174c04dba

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) Win 32 Exe x86

Link:

https://app.malva.re/file/232b67632733d8df1b118d76fd70c1f5

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9e05baee59cd27a85f08cf2fa678f54c3bb639f29d4521bfa0319bf174c04dba/

Verdict:

Malicious

Threat:

filerepmalware

Link:

https://tip.neiki.dev/file/9e05baee59cd27a85f08cf2fa678f54c3bb639f29d4521bfa0319bf174c04dba

Threat name:

Win32.Malware.Heuristic

Status:

Malicious

First seen:

2025-07-03 11:07:23 UTC

File Type:

PE (Exe)

AV detection:

14 of 24 (58.33%)

Threat level:

2/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=tyc3v3szzut2qxyiz4x2m6hvjq53mopstvcsdp5aggn7c5gajw5a._file

Result

Malware family:

hijackloader

Score:

10/10

Tags:

family:hijackloader discovery loader

Link:

https://tria.ge/reports/250703-rltazadr4x/

Behaviour

Suspicious behavior: AddClipboardFormatListener

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: GetForegroundWindowSpam

Suspicious behavior: MapViewOfSection

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Executes dropped EXE

Loads dropped DLL

Detects HijackLoader (aka IDAT Loader)

HijackLoader

Hijackloader family

Verdict:

Malicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/a3a0385a-a286-41fc-b05b-e748b210063f

Unpacked files

SH256 hash:

4e95f69c9d57bc0dfddbff598d3d2f346512e1e6d21942af20d25274f2736e11

MD5 hash:

8a507754e8ac1da1f593854cbd73b82f

SHA1 hash:

381196e35697ab3836cdeaa6d2cd6ee131354407

Link:

https://www.unpac.me/results/a49cd713-441a-4b73-81ef-724855765c99/

SH256 hash:

0823b2bf3fcc268f31281d520a29e8c0be43df4b2414c3023657f5257a9a103e

MD5 hash:

ebf678ed606696584c9252c051690e22

SHA1 hash:

5bf8a4854c17c75f6ae170ad7e6232ae8296d129

Detections:

win_samsam_auto

Link:

https://www.unpac.me/results/a49cd713-441a-4b73-81ef-724855765c99/

Parent samples :

2e8ac3980feb2ed56f39fac3763eed0fba77740a7b5cd74bccd8b7d59223c79d
64e2811f4c55a0b962e31c3fd01aa653ff5a55d56146ff2f4b6fbef6236c46a4
78ed91aa3f80105bc099ac45eb8c5d50536aeeab5442a81d80aedfa90e42988d
e68aaae515c5a9209fad7b4217f534de39b36ec66aff13c900c6c729e14dd31f
58a5e3bb70bcb50147587807794bcee8ee3c7e5c67a630b092e7899d2a50c83b
584bc504241fb7dc36f4c2ff5d38bf9757d9af5a369ca01027d2e151d53d932f
ff6ba4489c2fe94e5ed49e2bbb411abbb6677f73b56df746ffb36c6c0ea6b81f
9e05baee59cd27a85f08cf2fa678f54c3bb639f29d4521bfa0319bf174c04dba
6ffd4fb10bc191d0a3b5b47bec951397628f2dad1f5defce506c753c90c0f296
a7c5e1f4789b6b066c8030a3966786c99682371751c255e4e77d4b5a485237ae
46091fc17ded829d91a0563354ca16ff416f6b92912ad7ddd39ff326d787299b
f7540df042b56cb25b0f90b17255b173d9e078b1bc3bf72d4d7a476174ef9081
f28ec66ea72ab255e028b98e3103070e0e412030352b9c66aaf696266fed38ca
516523a72a445b175b620ee3ec70e0be6d7ddd9e217c22867527a3e17b7bb8b2
7dfe8d25b80b42ba7834c671f91956652ba929a239056bfc4321622eab60de3e
772b547b8e01d86b2d4a32e308a42388f298ca4faedb0d6a3b78fb0d4dce8826
cabf319baf5f3c955f6e251d101bdc61a1d7c3ced40e3f313c7d43f8571c00dd
9de72bbf7efdb9b528351ec7ad706d6197e860a78b2846adf700cbc10d0760fa

SH256 hash:

a6edb3fb6d21dd461da3767a7995034e208f7d6b08997f6cf7ee7b0ea833a8f0

MD5 hash:

cabb58bb5694f8b8269a73172c85b717

SHA1 hash:

9ed583c56385fed8e5e0757ddb2fdf025f96c807

Link:

https://www.unpac.me/results/a49cd713-441a-4b73-81ef-724855765c99/

SH256 hash:

68bee500e0080f21c003126e73b6d07804d23ac98b2376a8b76c26297d467abe

MD5 hash:

d4dae7149d6e4dab65ac554e55868e3b

SHA1 hash:

b3bea0a0a1f0a6f251bcf6a730a97acc933f269a

Link:

https://www.unpac.me/results/a49cd713-441a-4b73-81ef-724855765c99/

SH256 hash:

9e05baee59cd27a85f08cf2fa678f54c3bb639f29d4521bfa0319bf174c04dba

MD5 hash:

232b67632733d8df1b118d76fd70c1f5

SHA1 hash:

b198a045929d3ec21037502049f89170bdbf594d

Link:

https://www.unpac.me/results/a49cd713-441a-4b73-81ef-724855765c99/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9e05baee59cd27a85f08cf2fa678f54c3bb639f29d4521bfa0319bf174c04dba

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	APT_Sandworm_ArguePatch_Apr_2022_1 Create hunting rule
Author:	Arkbird_SOLG
Description:	Detect ArguePatch loader used by Sandworm group for load CaddyWiper
Reference:	https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/

Rule name:	Borland Create hunting rule
Author:	malware-lu

Rule name:	botnet_plaintext_c2 Create hunting rule
Author:	cip
Description:	Attempts to match at least some of the strings used in some botnet variants which use plaintext communication protocols.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__ConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	HeavensGate Create hunting rule
Author:	kevoreilly
Description:	Heaven's Gate: Switch from 32-bit to 64-mode

Rule name:	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCOM Create hunting rule
Author:	ditekSHen
Description:	Detects Windows exceutables bypassing UAC using CMSTP COM interfaces. MITRE (T1218.003)

Rule name:	malware_shellcode_hash Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect shellcode api hash value

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	shellcode Create hunting rule
Author:	nex
Description:	Matched shellcode byte patterns

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gh0stRAT

exe 9e05baee59cd27a85f08cf2fa678f54c3bb639f29d4521bfa0319bf174c04dba

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/3574819/

Delivery method

Distributed via web download

Cape

https://www.capesandbox.com/analysis/12163/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high

Reviews

ID	Capabilities	Evidence
AUTH_API	Manipulates User Authorization	advapi32.dll::AllocateAndInitializeSid advapi32.dll::ConvertSidToStringSidW advapi32.dll::ConvertStringSecurityDescriptorToSecurityDescriptorW advapi32.dll::EqualSid advapi32.dll::FreeSid
SECURITY_BASE_API	Uses Security Base API	advapi32.dll::AdjustTokenPrivileges advapi32.dll::GetTokenInformation
WIN32_PROCESS_API	Can Create Process and Threads	kernel32.dll::CreateProcessW advapi32.dll::OpenProcessToken advapi32.dll::OpenThreadToken kernel32.dll::CloseHandle kernel32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	kernel32.dll::LoadLibraryA kernel32.dll::LoadLibraryExW kernel32.dll::LoadLibraryW kernel32.dll::GetDriveTypeW kernel32.dll::GetVolumeInformationW kernel32.dll::GetSystemInfo
WIN_BASE_IO_API	Can Create Files	kernel32.dll::CreateDirectoryW kernel32.dll::CreateFileW kernel32.dll::DeleteFileW kernel32.dll::GetWindowsDirectoryW kernel32.dll::GetSystemDirectoryW kernel32.dll::GetFileAttributesW
WIN_BASE_USER_API	Retrieves Account Information	advapi32.dll::LookupPrivilegeValueW
WIN_REG_API	Can Manipulate Windows Registry	advapi32.dll::RegOpenKeyExW advapi32.dll::RegQueryValueExW
WIN_USER_API	Performs GUI Actions	user32.dll::PeekMessageW user32.dll::CreateWindowExW

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample