🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a95a25d7fe1d46df94f992e3a56be45edf5ef8f013aea95585a3b2f2d3bf9993. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gh0stRAT


Vendor detections: 17


Intelligence 17 IOCs 1 YARA 18 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a95a25d7fe1d46df94f992e3a56be45edf5ef8f013aea95585a3b2f2d3bf9993
SHA3-384 hash: 4e87324f3ada63d5e4371fabb278e297eb65925768c7de20eb0153dcc813367743c5564ca23279e5dbcecb1e7524cbbe
SHA1 hash: ef9c9a2719cb4c7071ca2eab6350c2f16f8e9a2b
MD5 hash: f46964c916274c48513d8f3cd0ad289d
humanhash: lithium-item-six-ack
File name:F46964C916274C48513D8F3CD0AD289D.exe
Download: download sample
Signature Gh0stRAT
Create hunting rule
File size:5'193'728 bytes
First seen:2025-11-25 07:05:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 2cb0f92664b0129f2adcd077ab089016 (1 x Gh0stRAT)
ssdeep 98304:4kkw8mJ0LMyfwX239FEBCh8pJisPgQuR7F/8cxsPB8E+QsPddJsPhOKsP:+ZpROC4q/JEze
Threatray 67 similar samples on MalwareBazaar
TLSH T19736BF01B781C032EAAB017099BDEB7A557DFA300B2585C7A3C42F5D6E305D2AE3975B
TrID 37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
12.7% (.EXE) Win64 Executable (generic) (10522/11/4)
7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
dhash icon f8fcee8e8e88e060 (1 x CobaltStrike, 1 x Gh0stRAT)
Reporter abuse_ch
Tags:exe Gh0stRAT RAT


Avatar
abuse_ch
Gh0stRAT C2:
101.43.156.141:6000

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
101.43.156.141:6000 https://threatfox.abuse.ch/ioc/1649892/

Intelligence

File Origin
# of uploads :
1
# of downloads :
166
Origin country :
NL NL
Vendor Threat Intelligence
Malware family:
gh0st
Create hunting rule
ID:
1
File name:
F46964C916274C48513D8F3CD0AD289D.exe
Verdict:
Malicious activity
Analysis date:
2025-11-25 07:07:32 UTC
Tags:
payload remote rat gh0st auto-reg
Link:
https://app.any.run/tasks/2170c392-f869-476f-a23a-4e063982fc9b

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/41419/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69255579587b4206e7f2ae89
Tags:
shellcode dropper emotet virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt
Sending an HTTP GET request
Launching cmd.exe command interpreter
Сreating synchronization primitives
Creating a window
Creating a file
Searching for the window
Sending a custom TCP request
DNS request
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a system process
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/a95a25d7fe1d46df94f992e3a56be45edf5ef8f013aea95585a3b2f2d3bf9993
Verdict:
Malicious
File Type:
exe x32
First seen:
2025-11-22T11:06:00Z UTC
Last seen:
2025-11-26T08:19:00Z UTC
Hits:
~100
Detections:
HEUR:Trojan-Spy.Win32.AntiAV.gen Backdoor.Win32.Androm PDM:Trojan.Win32.Generic Backdoor.Agent.TCP.C&C Trojan-Dropper.Win32.Injector.sb Trojan-Dropper.Win32.Dapato.sb Trojan.Win32.Inject.sb Trojan.Win32.Agent.sb Backdoor.Win32.WOC.sb
Link:
https://opentip.kaspersky.com/a95a25d7fe1d46df94f992e3a56be45edf5ef8f013aea95585a3b2f2d3bf9993/results?tab=lookup
Malware family:
ValleyRAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/f5ae316b-9b1b-4fd6-80ef-33cf68eeb64a
Result
Threat name:
GhostRat
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1820358
Signature
Allocates memory in foreign processes
C2 URLs / IPs found in malware configuration
Contain functionality to detect virtual machines
Contains functionality to access PhysicalDrive, possible boot sector overwrite
Contains functionality to infect the boot sector
Contains functionality to inject code into remote processes
Found API chain indicative of debugger detection
Found API chain indicative of sandbox detection
Found malware configuration
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Multi AV Scanner detection for submitted file
Sigma detected: Potentially Suspicious Malware Callback Communication
Uses known network protocols on non-standard ports
Writes to foreign memory regions
Yara detected GhostRat
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1820358 Sample: sm1Yt7Ft8a.exe Startdate: 25/11/2025 Architecture: WINDOWS Score: 100 32 iamasbcx.asuscomm.com 2->32 44 Found malware configuration 2->44 46 Multi AV Scanner detection for submitted file 2->46 48 Yara detected GhostRat 2->48 50 4 other signatures 2->50 8 sm1Yt7Ft8a.exe 1 13 2->8         started        13 sm1Yt7Ft8a.exe 12 2->13         started        15 sm1Yt7Ft8a.exe 12 2->15         started        signatures3 process4 dnsIp5 34 101.43.156.141, 49687, 49688, 49695 CNIX-APChinaNetworksInter-ExchangeCN China 8->34 30 C:\Users\user\AppData\Local\...\1[1].bin, DOS 8->30 dropped 52 Contains functionality to inject code into remote processes 8->52 54 Writes to foreign memory regions 8->54 56 Allocates memory in foreign processes 8->56 17 cmd.exe 9 1 8->17         started        58 Injects a PE file into a foreign processes 13->58 20 cmd.exe 13->20         started        22 cmd.exe 15->22         started        file6 signatures7 process8 signatures9 36 Contains functionality to access PhysicalDrive, possible boot sector overwrite 17->36 38 Found API chain indicative of debugger detection 17->38 40 Found API chain indicative of sandbox detection 17->40 42 2 other signatures 17->42 24 WerFault.exe 20 16 17->24         started        26 WerFault.exe 21 20->26         started        28 WerFault.exe 21 22->28         started        process10
Score:
89%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/a95a25d7fe1d46df94f992e3a56be45edf5ef8f013aea95585a3b2f2d3bf9993
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/f46964c916274c48513d8f3cd0ad289d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a95a25d7fe1d46df94f992e3a56be45edf5ef8f013aea95585a3b2f2d3bf9993/
Verdict:
Malicious
Threat:
Backdoor.Win32.Inject
Link:
https://tip.neiki.dev/file/a95a25d7fe1d46df94f992e3a56be45edf5ef8f013aea95585a3b2f2d3bf9993
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=vfnclv76dvdn7fhzslr2k27el3pv56hqcoxksvmfuozpfu57tgjq._file
Verdict:
malicious
Label(s):
valleyrat
Create hunting rule
Similar samples:
3e48c8b65e16ddc17062ee3df281a35647bb5dcc9d4cbe24efd68046c96a55b3
Gh0stRAT
68b218fd7fff25d1e49a2ae9d087bb323e09b0e04770ab518dddad89a454d520
Gh0stRAT
a14f448e7fbeed5aee2f0db602bca444bb821e731452e0e43f914b1cd902fec5
Gh0stRAT
a95a25d7fe1d46df94f992e3a56be45edf5ef8f013aea95585a3b2f2d3bf9993
Gh0stRAT
c56e802f6c74bb4a2bd19469e1998c088458766f38fbed4cb21a37e2df9ed5e3
Gh0stRAT
error
Gh0stRAT
+ 57 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  6/10
Tags:
discovery persistence
Link:
https://tria.ge/reports/251125-hwsyhsak2s/
Behaviour
System Location Discovery: System Language Discovery
Adds Run key to start application
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/76839adb-9751-43b8-ad8b-a65afd640ec7
Unpacked files
SH256 hash:
a95a25d7fe1d46df94f992e3a56be45edf5ef8f013aea95585a3b2f2d3bf9993
MD5 hash:
f46964c916274c48513d8f3cd0ad289d
SHA1 hash:
ef9c9a2719cb4c7071ca2eab6350c2f16f8e9a2b
Link:
https://www.unpac.me/results/e4f90252-85f0-4779-b463-5f8d33146320/
SH256 hash:
28efc67df575ad40fc71ec6f8dbe12317e1928a4c1dc4b57f3a6dfda34149ede
MD5 hash:
c962b36128fbba1ed24ffffb9fb014f0
SHA1 hash:
d103f24f296b410306d43cab4c8183f942165617
Link:
https://www.unpac.me/results/e4f90252-85f0-4779-b463-5f8d33146320/
SH256 hash:
f5e826458c79845a3b017fc34b0c03d8a6f4b3d2bb58685386a9e87c76842768
MD5 hash:
a7bcb312c4b33a9f639099a8540e647c
SHA1 hash:
4383bf470b167b7619c4f6048b3799b92ca0bc00
Detections:
win_samsam_auto
Create hunting rule
Link:
https://www.unpac.me/results/e4f90252-85f0-4779-b463-5f8d33146320/
SH256 hash:
b4f8d05e85a7965cbe65a0c33208c0bcaf9a72baedadf6af713352b549620a62
MD5 hash:
1e974833b874430f12b796ebc175237a
SHA1 hash:
b42f91ed7a665e6162defd4d81062c633b9bc679
Link:
https://www.unpac.me/results/e4f90252-85f0-4779-b463-5f8d33146320/
SH256 hash:
b9ca4fa6df8cd07278b8d3fd5d6fa3fff516884f75038ebdfc5d648d570b436b
MD5 hash:
4db3e4424af850864a2d9199ca6d7092
SHA1 hash:
893e38423e90e1d8ac86a8755f5d22ab9edb2436
Link:
https://www.unpac.me/results/e4f90252-85f0-4779-b463-5f8d33146320/
SH256 hash:
528cd2f7944bd512c44f3874d823caf86ad9dddf1ac37c4e8cd47310b8fed6c6
MD5 hash:
55e8405ca1a140ae6dfd60e990ce3def
SHA1 hash:
4c02283af0f49d243c3dea01066d07a932cd1198
Detections:
win_samsam_auto
Create hunting rule
Link:
https://www.unpac.me/results/e4f90252-85f0-4779-b463-5f8d33146320/
SH256 hash:
b5745506409bdf3969e85e87982a8d610986dfe0158ed581edaeb1a702c9e817
MD5 hash:
baaef314eb1dc199d10fe47803da9d36
SHA1 hash:
2c7ad3368bad9633394d1aa66e3f3ccbf035f76b
Link:
https://www.unpac.me/results/e4f90252-85f0-4779-b463-5f8d33146320/
SH256 hash:
ba0eab2608f8f98b31b8aa305b1b00508abcd3371c297b20772a98da0d7b20f4
MD5 hash:
b2c6c584989d72590936d363597a6bb1
SHA1 hash:
a18677f9a4c5efd810ac7de837d96c1b2d313b68
Link:
https://www.unpac.me/results/e4f90252-85f0-4779-b463-5f8d33146320/
SH256 hash:
7b6c8e2418446b18bad4c04e8e1e956b981f651e7b552bd885f5d5849fc55fcb
MD5 hash:
01e9e8696c27736377fd3c8f94c2aef1
SHA1 hash:
3d92aa30ed33ae742a9f620fc4d5b38bc48d624e
Link:
https://www.unpac.me/results/e4f90252-85f0-4779-b463-5f8d33146320/
Malware family:
ValleyRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/a95a25d7fe1d/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Farfli
Score:
0.90
Link:
https://yomi.yoroi.company/submissions/a95a25d7fe1d46df94f992e3a56be45edf5ef8f013aea95585a3b2f2d3bf9993

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Check_DriveSize
Create hunting rule
Rule name:cleanup_loader_payload_v1
Create hunting rule
Author:RandomMalware
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:dgaagas
Create hunting rule
Author:Harshit
Description:Uses certutil.exe to download a file named test.txt
Rule name:Gh0stKCP
Create hunting rule
Author:Netresec
Description:Detects HP-Socket ARQ and KCP implementations, which are used in Gh0stKCP. Forked from @stvemillertime's KCP catchall rule.
Reference:https://netresec.com/?b=259a5af
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:RIPEMD160_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for RIPEMD-160 constants
Rule name:SHA1_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA1 constants
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:Windows_Trojan_DustyWarehouse_a6cfc9f7
Create hunting rule
Author:Elastic Security

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/41419/

Comments