🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b34966c661b9cf5cfc69dc06f129bd3c9f66a437687564a0a90bbb2e3b41db3b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gh0stRAT


Vendor detections: 15


Intelligence 15 IOCs 1 YARA 8 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b34966c661b9cf5cfc69dc06f129bd3c9f66a437687564a0a90bbb2e3b41db3b
SHA3-384 hash: 3cfa35aa41b09afcfbb7e6ee7fc54aaf915dc0741a6ad485f51faf5a48117893a5878d2655d59d6141081f9c7bc5eec5
SHA1 hash: 105490b9dfa60d97f5d1fe71906189617d0c2e9e
MD5 hash: 1478c5313977829090d46f9d1f85ea75
humanhash: bakerloo-black-princess-pasta
File name:1478C5313977829090D46F9D1F85EA75.dll
Download: download sample
Signature Gh0stRAT
Create hunting rule
File size:176'128 bytes
First seen:2025-11-11 14:40:06 UTC
Last seen:Never
File type:DLL dll
MIME type:application/x-dosexec
imphash b6fe1394ce89e6c21fe5af76775c6e31 (9 x Gh0stRAT)
ssdeep 3072:W/gWEkncfFsQTvrhPkC7xZkuXaJhNeETNsAq6nUlk6/MPNm:WLPnc2qrJ51ZkMaJhQCNBU8
Threatray 73 similar samples on MalwareBazaar
TLSH T1B1047D01F7C901E9E176913C99FA6B36DA3374140B288BCB6754CA991A23AD5FF36307
TrID 37.8% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
20.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
12.7% (.EXE) Win64 Executable (generic) (10522/11/4)
7.9% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
6.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
Reporter abuse_ch
Tags:dll Gh0stRAT RAT


Avatar
abuse_ch
Gh0stRAT C2:
122.199.176.225:9735

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
122.199.176.225:9735 https://threatfox.abuse.ch/ioc/1638692/

Intelligence

File Origin
# of uploads :
1
# of downloads :
208
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/36776/
Detection(s):
Win.Trojan.Farfli-9753454-0
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69134ad7ac1ae236e17972c6
Tags:
zegost farfli madi
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context anti-debug cmd expand farfli graftor keylogger keylogger lolbin microsoft_visual_cc rundll32
Link:
https://www.filescan.io/uploads/69134ad3935d9f0d73cd7e69/reports/9236c169-1423-4750-b6af-65e959439cb6/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/b34966c661b9cf5cfc69dc06f129bd3c9f66a437687564a0a90bbb2e3b41db3b
Verdict:
Malicious
File Type:
dll x32
First seen:
2025-09-03T00:01:00Z UTC
Last seen:
2025-11-12T06:19:00Z UTC
Hits:
~10
Detections:
PDM:Trojan.Win32.Generic HEUR:Trojan.Win32.Generic HEUR:Trojan.Multi.Dllhijacker.gen Backdoor.Win32.Zegost.sb
Link:
https://opentip.kaspersky.com/b34966c661b9cf5cfc69dc06f129bd3c9f66a437687564a0a90bbb2e3b41db3b/results?tab=lookup
Malware family:
Barys
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/5ef86014-bf3d-4cfe-9e92-c36cf8515196
Result
Threat name:
GhostRat, Xmrig
Create hunting rule
Detection:
malicious
Classification:
troj.evad.mine
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1812085
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
C2 URLs / IPs found in malware configuration
Changes security center settings (notifications, updates, antivirus, firewall)
Contains functionality to detect sleep reduction / modifications
Creates files in the system32 config directory
Drops executables to the windows directory (C:\Windows) and starts them
Found malware configuration
Found stalling execution ending in API Sleep call
Found strings related to Crypto-Mining
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
PE file has a writeable .text section
Sigma detected: Execute DLL with spoofed extension
Suricata IDS alerts for network traffic
System process connects to network (likely due to code injection or exploit)
Yara detected GhostRat
Yara detected Xmrig cryptocurrency miner
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1812085 Sample: bBIHDhp1SM.dll Startdate: 11/11/2025 Architecture: WINDOWS Score: 100 91 Suricata IDS alerts for network traffic 2->91 93 Found malware configuration 2->93 95 Malicious sample detected (through community Yara rule) 2->95 97 11 other signatures 2->97 8 loaddll32.exe 4 2->8         started        10 svchost.exe 3 2->10         started        13 svchost.exe 2->13         started        15 7 other processes 2->15 process3 signatures4 17 rundll32.exe 8->17         started        21 rundll32.exe 2 5 8->21         started        23 cmd.exe 1 8->23         started        36 5 other processes 8->36 107 Contains functionality to detect sleep reduction / modifications 10->107 25 rundll32.exe 1 14 10->25         started        109 Changes security center settings (notifications, updates, antivirus, firewall) 13->109 28 MpCmdRun.exe 13->28         started        30 WerFault.exe 2 15->30         started        32 WerFault.exe 2 15->32         started        34 WerFault.exe 15->34         started        process5 dnsIp6 65 C:\Users\user\Desktop\s5.exe, PE32 17->65 dropped 67 C:\Users\user\AppData\Local\...\s5[1].exe, PE32 17->67 dropped 99 System process connects to network (likely due to code injection or exploit) 17->99 101 Drops executables to the windows directory (C:\Windows) and starts them 17->101 38 cmd.exe 17->38         started        40 s5.exe 17->40         started        103 Found stalling execution ending in API Sleep call 21->103 105 Contains functionality to detect sleep reduction / modifications 21->105 42 WerFault.exe 28 17 21->42         started        44 rundll32.exe 3 5 23->44         started        79 122.199.176.225, 49716, 49723, 49726 NEXG-AS-KRNexGCoLTDKR Korea Republic of 25->79 81 210.206.36.201, 49742, 49746, 80 LGDACOMLGDACOMCorporationKR Korea Republic of 25->81 69 C:\Windows\SysWOW64\s5.exe, PE32 25->69 dropped 71 C:\Windows\SysWOW64\config\...\s5[1].exe, PE32 25->71 dropped 47 s5.exe 25->47         started        51 cmd.exe 25->51         started        53 conhost.exe 28->53         started        55 WerFault.exe 36->55         started        file7 signatures8 process9 dnsIp10 57 conhost.exe 38->57         started        73 C:\Program Files (x86)cdrw\kuyg.jpg, PE32 44->73 dropped 75 C:\...\kuyg.jpg:Zone.Identifier, ASCII 44->75 dropped 59 WerFault.exe 20 16 44->59         started        83 210.107.84.253, 49745, 80 LGDACOMLGDACOMCorporationKR Korea Republic of 47->83 77 C:\Program Files (x86)\Windows NT\mtn.exe, PE32+ 47->77 dropped 85 Multi AV Scanner detection for dropped file 47->85 87 Creates files in the system32 config directory 47->87 89 Found strings related to Crypto-Mining 47->89 61 conhost.exe 51->61         started        63 taskkill.exe 51->63         started        file11 signatures12 process13
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/b34966c661b9cf5cfc69dc06f129bd3c9f66a437687564a0a90bbb2e3b41db3b
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/1478c5313977829090d46f9d1f85ea75
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b34966c661b9cf5cfc69dc06f129bd3c9f66a437687564a0a90bbb2e3b41db3b/
Verdict:
Malicious
Threat:
Family.GH0STRAT
Link:
https://tip.neiki.dev/file/b34966c661b9cf5cfc69dc06f129bd3c9f66a437687564a0a90bbb2e3b41db3b
Threat name:
Win32.Backdoor.Zegost
Create hunting rule
Status:
Malicious
First seen:
2025-09-03 06:34:01 UTC
File Type:
PE (Dll)
Extracted files:
2
AV detection:
34 of 38 (89.47%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=wnewnrtbxhhvz7dj3qdpckn5hspwnjbxnb2wjifjbo5s4o2b3m5q._file
Verdict:
malicious
Label(s):
gh0strat
Create hunting rule
Similar samples:
61f912711999dda9a5b65188e6ef44daf977f2d7013432b4db8d6b8b8449ab80
Gh0stRAT
ac7bbace6a05f3ea6422306fe0f41c3a5252579c3a584150e9628f53a7805b50
Gh0stRAT
b34966c661b9cf5cfc69dc06f129bd3c9f66a437687564a0a90bbb2e3b41db3b
Gh0stRAT
bb7f474008142e7f8a81dfd3bb121b99e23bc262c2ef34c83cd33cc3db5f5509
Gh0stRAT
error
Gh0stRAT
f0d3e8055002cd44d26765a93a18506e127874c0ba73e54bf5543b743647f7a5
Gh0stRAT
+ 63 additional samples on MalwareBazaar
Result
Malware family:
gh0strat
Create hunting rule
Score:
  10/10
Tags:
family:gh0strat discovery rat
Link:
https://tria.ge/reports/251111-r11nlaxlbk/
Behaviour
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Program crash
System Location Discovery: System Language Discovery
Loads dropped DLL
Badlisted process makes network request
Gh0st RAT payload
Gh0strat
Gh0strat family
Unpacked files
SH256 hash:
b34966c661b9cf5cfc69dc06f129bd3c9f66a437687564a0a90bbb2e3b41db3b
MD5 hash:
1478c5313977829090d46f9d1f85ea75
SHA1 hash:
105490b9dfa60d97f5d1fe71906189617d0c2e9e
Link:
https://www.unpac.me/results/a0dc3161-5bfb-485c-9ab4-cc5c9d0e4b2d/
SH256 hash:
111f84e27210508af75d586f6e107f5465ddff68cb8545e9327ad1ae69337ed1
MD5 hash:
317cd1ce327b6520bf4ee007bcd39e61
SHA1 hash:
2f1113395ca0491080d1092c3636cda6cf711998
Link:
https://www.unpac.me/results/a0dc3161-5bfb-485c-9ab4-cc5c9d0e4b2d/
Malware family:
Gh0stRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/b34966c661b9/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
PcClient
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b34966c661b9cf5cfc69dc06f129bd3c9f66a437687564a0a90bbb2e3b41db3b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Armadillov1xxv2xx
Create hunting rule
Author:malware-lu
Rule name:Check_OutputDebugStringA_iat
Create hunting rule
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:meth_stackstrings
Create hunting rule
Author:Willi Ballenthin

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/36776/

Comments