MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 ae0c2b4ed2f3beac01a8997f8ac0cfa78d01e9b55e5cc70b490441e756fee039. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Gh0stRAT
Vendor detections: 7
| SHA256 hash: | ae0c2b4ed2f3beac01a8997f8ac0cfa78d01e9b55e5cc70b490441e756fee039 |
|---|---|
| SHA3-384 hash: | 671cba12e29358e4047532de27ee505099b01e067baebe0abaec72d85302cbe82af289ccd0140d97a0e6a47e89ad6a36 |
| SHA1 hash: | 8ac27e167ba9459f3434bf055ce90a0c3681e13b |
| MD5 hash: | c2d157d99942dc12dfe9dcaad5304866 |
| humanhash: | white-july-california-nevada |
| File name: | SpaceCityV2.exe |
| Download: | download sample |
| Signature | Gh0stRAT |
| File size: | 793'600 bytes |
| First seen: | 2022-12-16 14:34:09 UTC |
| Last seen: | 2022-12-16 16:37:00 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | d13d399db15c51a1337d692663151209 (3 x Gh0stRAT, 1 x Zegost) |
| ssdeep | 12288:jaia+of8EJE4zszA+MkJPSS7lWo/TzzDqsZDD9OItfD5HgHq/lLg2z:jaizYtsM6THDqWDgwfZ8YLg2z |
| Threatray | 206 similar samples on MalwareBazaar |
| TLSH | T1C5F45A27E3B18BBDC156C13E81A28E09A73FB87D0733C1D745928619EB59AC01F3566E |
| TrID | 59.1% (.SCR) Windows screen saver (13097/50/3) 13.5% (.MZP) WinArchiver Mountable compressed Archive (3000/1) 9.1% (.EXE) OS/2 Executable (generic) (2029/13) 9.0% (.EXE) Generic Win/DOS Executable (2002/3) 9.0% (.EXE) DOS Executable Generic (2000/1) |
| File icon (PE): |  |
| dhash icon | 7b4fcc44361e14a4 (3 x Gh0stRAT, 1 x Zegost) |
| Reporter |  iamdeadlyz |
| Tags: | 45-153-241-207 exe FakeGaliXCity Gh0stRAT SpaceCity |
Iamdeadlyz
From spacecity.games (impersonation of galixcity.io)Taken from: 888911f248e764f4a7ece25cab594a925bf13eb797fd1578b824d592a7719814
Gh0stRAT C&C: 45.153.241.207:1016
Intelligence
File Origin
# of uploads :
2
# of downloads :
199
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SpaceCityV2.exe
Verdict:
No threats detected
Analysis date:
2022-12-16 14:36:22 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
Clean
Maliciousness:
Behaviour
Creating a file in the %temp% directory
Creating a window
Sending a custom TCP request
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
MalwareBazaar
CheckNumberOfProcessor
LanguageCheck
CheckCmdLine
Verdict:
No Threat
Threat level:
2/10
Confidence:
100%
Tags:
cmd.exe packed
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Result
Threat name:
Unknown
Detection:
malicious
Classification:
n/a
Score:
48 / 100
Signature
Malicious sample detected (through community Yara rule)
Behaviour
Behavior Graph:
Detection(s):
Suspicious file
Verdict:
unknown
Similar samples:
+ 196 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
1/10
Tags:
n/a
Behaviour
Suspicious use of WriteProcessMemory
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
ae0c2b4ed2f3beac01a8997f8ac0cfa78d01e9b55e5cc70b490441e756fee039
MD5 hash:
c2d157d99942dc12dfe9dcaad5304866
SHA1 hash:
8ac27e167ba9459f3434bf055ce90a0c3681e13b
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
888911f248e764f4a7ece25cab594a925bf13eb797fd1578b824d592a7719814
bat Dropped by
SHA256 888911f248e764f4a7ece25cab594a925bf13eb797fd1578b824d592a7719814
Dropping
SHA256 75a050c99cb24f2bfb3f40502fb960644e7c2f4ed143fdb5479a95a2ad487482
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.