MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f0b53652202ef427b78a25412c87d27261e7eedbb55a240466c5bcf770ddadc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gh0stRAT


Vendor detections: 11


Intelligence 11 IOCs 1 YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9f0b53652202ef427b78a25412c87d27261e7eedbb55a240466c5bcf770ddadc
SHA3-384 hash: 680282344a1895300a161c674a96022d16af0140bbb5a23cca81947b0ca47b2ab10c22ea4cb16bf33c65b3f0fc47fa4d
SHA1 hash: dae61e6aac0c569c060c4f6888fe90a5f3ed06b7
MD5 hash: 28b5d25a335fc6bd044b638568c55424
humanhash: dakota-lake-oregon-seven
File name:28b5d25a335fc6bd044b638568c55424.exe
Download: download sample
Signature Gh0stRAT
Create hunting rule
File size:6'799'375 bytes
First seen:2022-10-10 02:15:41 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 0533f8fc6d242682a6c09fa97fd55f21 (10 x Gh0stRAT)
ssdeep 12288:Beh5EsIY4dNPEf090Ny2ytBRVfhSC0+EWBQ+:Beh5EsfsNPwyNtBRZdEWBH
Threatray 57 similar samples on MalwareBazaar
TLSH T18B66A063A587B657E781593940FDBB725C3BAF141E239583A328FD345E2324B3A23316
TrID 38.8% (.EXE) Win32 Executable (generic) (4505/5/1)
17.5% (.EXE) DOS Executable Borland Pascal 7.0x (2035/25)
17.2% (.EXE) Generic Win/DOS Executable (2002/3)
17.2% (.EXE) DOS Executable Generic (2000/1)
8.6% (.SCORE) Music Craft Score (1007/6)
File icon (PE):PE icon
dhash icon b2dbdc0901496412 (1 x Gh0stRAT)
Reporter abuse_ch
Tags:exe Gh0stRAT


Avatar
abuse_ch
Gh0stRAT C2:
121.4.122.206:37936

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
121.4.122.206:37936 https://threatfox.abuse.ch/ioc/872603/

Intelligence

File Origin
# of uploads :
1
# of downloads :
410
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/318089/
Detection(s):
SecuriteInfo.com.VBS.Obfus-183.UNOFFICIAL
Create hunting rule

Win.Dropper.Gh0stRAT-6992317-0
Create hunting rule

Win.Malware.Aepxwwo-6958508-1
Create hunting rule

Win.Trojan.Redosdru-9875198-0
Create hunting rule

Win.Trojan.Gh0st-9885322-0
Create hunting rule

Win.Trojan.Zbot-9885326-0
Create hunting rule

Win.Trojan.Generic-9888167-0
Create hunting rule

Win.Trojan.Zegost-9945988-0
Create hunting rule

Win.Trojan.Swisyn-6958492-0
Create hunting rule

Win.Trojan.Magania-6971504-0
Create hunting rule

Win.Worm.Palevo-24499
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Сreating synchronization primitives
Creating a file in the Windows directory
Creating a file
Creating a file in the Windows subdirectories
Searching for synchronization primitives
DNS request
Sending a custom TCP request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive explorer.exe gh0st ghost greyware lime overlay packed palevo shell32.dll swisyn
Link:
https://www.filescan.io/uploads/63438063b321c2e8ff63c3fc/reports/4e570538-f60f-4775-8cdf-5dc5938715c1/overview
Result
Verdict:
MALICIOUS
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/ca8f4d78-546c-4471-a732-a4f302d56b26
Result
Threat name:
GhostRat
Create hunting rule
Detection:
malicious
Classification:
troj.adwa.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1086626
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Contains functionality to capture and log keystrokes
Contains functionality to detect sleep reduction / modifications
Contains functionality to detect virtual machines (IN, VMware)
Creates an autostart registry key pointing to binary in C:\Windows
Drops executables to the windows directory (C:\Windows) and starts them
Drops PE files to the startup folder
Drops PE files with a suspicious file extension
Found stalling execution ending in API Sleep call
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Yara detected GhostRat
Behaviour
Behavior Graph:
Download SVG
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9f0b53652202ef427b78a25412c87d27261e7eedbb55a240466c5bcf770ddadc/
Threat name:
Win32.Infostealer.Magania
Create hunting rule
Status:
Malicious
First seen:
2022-10-06 05:54:00 UTC
File Type:
PE (Exe)
Extracted files:
33
AV detection:
25 of 26 (96.15%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=t4fvgzjcalxue63yujkbfsd5e4tb47xnxnk2eqcgnrn465yn3loa._file
Verdict:
malicious
Similar samples:
0e723b24c00d40e82c3040be920ea71fa0c8f868d009f66310250f7286eeb3c7
Gh0stRAT
1572e78bd040b8ba1a070b495df92ad34deb842e8edd732c1e4dc2c83f76357c
Gh0stRAT
96693934ea434357522fd15757ae0a757e2d93c080d900f152b66b428afb1526
Gh0stRAT
a5a8a35bc7f082b6107a1b19ecd0b78d4467b4159689ef6d1030be7d1ba19c6c
Gh0stRAT
becc6f8e5b34bc2ccac9d11b1dd7b62278f79ac242649d656278e3947a24f5e0
Gh0stRAT
+ 47 additional samples on MalwareBazaar
Result
Malware family:
gh0strat
Create hunting rule
Score:
  10/10
Tags:
family:gh0strat persistence
Link:
https://tria.ge/reports/221010-cp5qvaacg3/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Drops file in Windows directory
Drops file in System32 directory
Adds Run key to start application
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/5223eccd-d7a2-43a4-9016-b3ea9490cca7
Unpacked files
SH256 hash:
9f0b53652202ef427b78a25412c87d27261e7eedbb55a240466c5bcf770ddadc
MD5 hash:
28b5d25a335fc6bd044b638568c55424
SHA1 hash:
dae61e6aac0c569c060c4f6888fe90a5f3ed06b7
Link:
https://www.unpac.me/results/f890e15a-956e-4aa2-990f-7e917801e8f2/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9f0b53652202/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Backdoor
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/9f0b53652202ef427b78a25412c87d27261e7eedbb55a240466c5bcf770ddadc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:BitcoinAddress
Create hunting rule
Author:Didier Stevens (@DidierStevens)
Description:Contains a valid Bitcoin address
Rule name:INDICATOR_SUSPICIOUS_EXE_RegKeyComb_RDP
Create hunting rule
Author:ditekSHen
Description:Detects executables embedding registry key / value combination manipulating RDP / Terminal Services
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin
Rule name:Typical_Malware_String_Transforms
Create hunting rule
Author:Florian Roth
Description:Detects typical strings in a reversed or otherwise modified form
Reference:Internal Research
Rule name:Typical_Malware_String_Transforms_RID3473
Create hunting rule
Author:Florian Roth
Description:Detects typical strings in a reversed or otherwise modified form
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/318089/

Comments