🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c5418c52bdf33f70aff9bcf014d3f10c4661a87ff2dbc8747feaa10415fc5e52. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gh0stRAT


Vendor detections: 14


Intelligence 14 IOCs YARA 27 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c5418c52bdf33f70aff9bcf014d3f10c4661a87ff2dbc8747feaa10415fc5e52
SHA3-384 hash: 59f5381451d686e50b90647a8c3034bf3ed118676aca1b7d600109532773a4641cedab8f4e06549a570d8f8434153129
SHA1 hash: e647a44181857ab6eb2c1611ec1aaf3b9951039b
MD5 hash: d52e600aa64cc141628c3e9ea3b871e6
humanhash: hawaii-cardinal-ink-stream
File name:BANDIZIPSETUP.exe
Download: download sample
Signature Gh0stRAT
Create hunting rule
File size:37'447'616 bytes
First seen:2026-10-31 16:40:33 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 6d5e13c0269946a5a10390c178d8e9a5 (8 x ValleyRAT, 7 x Gh0stRAT, 2 x CoinMiner)
ssdeep 786432:tJqHlyDSs9Jf3ASYa4hyI30fC/hl8K9HHHVq/1yfgYZ+8ddqbr4:tJqHlyDSsL/BqyI30ADl9HHs/1SdA
TLSH T158871231369EC43BE16905B15A2CAEAA913C6E360FB154C7B3EC7D5A17754C20237E2B
TrID 29.5% (.EXE) Win64 Executable (generic) (6522/11/2)
22.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
20.3% (.EXE) Win32 Executable (generic) (4504/4/1)
9.1% (.EXE) OS/2 Executable (generic) (2029/13)
9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
dhash icon 68f8d9d3d9d83c80 (1 x Gh0stRAT)
Reporter Ling
Tags:exe Gh0stRAT signed SilverFox ValleyRAT

Code Signing Certificate

Organisation:Chongqing JingYue Technology Co., Ltd
Issuer:VeriSign Class 3 Code Signing 2010 CA
Algorithm:sha1WithRSAEncryption
Valid from:2013-05-14T00:00:00Z
Valid to:2014-05-14T23:59:59Z
Serial number: 0e13ae953b308dd8689fc9903d4abf9c
Thumbprint Algorithm:SHA256
Thumbprint: 85627a2ab1b7a48483f769b575e939feee93b4bdee632885d096780cf683e108
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform


Avatar
CNGaoLing
The sample is retrieved from "https://www.bandizip.dev" / "https://www.bandizip.vip" -> "https://www.bandizip.dev/downloads/BANDIZIPSETUP.zip"

SilverFox
IOC (Domain www.flunz4aod.com) (IP 206.119.174.71 :25 / :80)

Intelligence

File Origin
# of uploads :
1
# of downloads :
219
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
gh0st
Create hunting rule
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-10-31 16:46:55 UTC
Tags:
advancedinstaller rat gh0st
Link:
https://app.any.run/tasks/858f4346-d729-4af4-9b67-97b7573cc1e4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae61a36b175ade21dcec864
Tags:
injection dropper extens
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating synchronization primitives
Creating a file in the %AppData% subdirectories
Searching for synchronization primitives
Creating a file in the %temp% directory
Deleting a recently created file
Loading a suspicious library
Launching a process
Modifying a system file
Creating a file in the Windows subdirectories
Creating a file in the Program Files subdirectories
Creating a process from a recently created file
Searching for the window
Creating a file
Sending a custom TCP request
DNS request
Moving a recently created file
Connection attempt
Creating a process with a hidden window
Sending an HTTP GET request
Launching a service
Creating a service
Enabling autorun for a service
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
adaptive-context adaptive-context advanced_installer anti-debug anti-vm base64 dllhost expired-cert explorer explorer fingerprint installer installer lolbin lolbin microsoft_visual_cc packed reconnaissance signed
Link:
https://www.filescan.io/uploads/6ae61a31eb3dda378d3f06a0/reports/b2b2181c-134f-4169-b77d-7650794079a2/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_70%
Link:
https://www.hybrid-analysis.com/sample/c5418c52bdf33f70aff9bcf014d3f10c4661a87ff2dbc8747feaa10415fc5e52
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-10-27T16:30:00Z UTC
Last seen:
2026-10-30T02:55:00Z UTC
Hits:
~10
Detections:
BSS:Trojan.Win32.Generic Trojan.Win64.Agent.sba Trojan.Win32.Waldek.sb Trojan-Spy.Win32.Stealer.sb HEUR:Trojan-Dropper.Win32.Generic Trojan-Dropper.Win32.Silverfox.sb Trojan.MSIL.BypassUAC.sb Trojan-Spy.Win64.Agent.sb Trojan-Dropper.Win32.Silverfox.bxg
Link:
https://opentip.kaspersky.com/c5418c52bdf33f70aff9bcf014d3f10c4661a87ff2dbc8747feaa10415fc5e52/results?tab=lookup
Result
Threat name:
n/a
Detection:
suspicious
Classification:
n/a
Score:
32 / 100
Link:
https://www.joesandbox.com/analysis/1995905
Signature
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Suricata IDS alerts for network traffic
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1995905 Sample: BANDIZIPSETUP.exe Startdate: 31/10/2026 Architecture: WINDOWS Score: 32 59 fy.jinbaofa.com 2->59 61 www.flunz4aod.com 2->61 63 2 other IPs or domains 2->63 65 Suricata IDS alerts for network traffic 2->65 67 Multi AV Scanner detection for dropped file 2->67 69 Multi AV Scanner detection for submitted file 2->69 9 msiexec.exe 15 35 2->9         started        12 BANDIZIPSETUP.exe 28 2->12         started        signatures3 process4 file5 31 C:\Windows\Installer\MSI4F88.tmp, PE32 9->31 dropped 33 C:\Windows\Installer\MSI4F38.tmp, PE32 9->33 dropped 35 C:\Windows\Installer\MSI4EBA.tmp, PE32 9->35 dropped 43 5 other malicious files 9->43 dropped 14 5B4F34.exe 2 9->14         started        17 BANDIZIP-SETUP-STD-ALL.exe 2 6 9->17         started        20 msiexec.exe 9->20         started        22 msiexec.exe 9->22         started        37 C:\Users\user\AppData\Local\...\shi43F9.tmp, PE32+ 12->37 dropped 39 C:\Users\user\AppData\Local\...\pre47E5.tmp, PE32 12->39 dropped 41 C:\Users\user\AppData\Local\...\MSI4758.tmp, PE32 12->41 dropped 45 2 other malicious files 12->45 dropped 24 msiexec.exe 4 12->24         started        process6 dnsIp7 55 C:\Users\user\AppData\Local\...\5B4F34.tmp, PE32 14->55 dropped 26 5B4F34.tmp 10 14->26         started        57 ver.bandi.so 52.78.169.250, 443, 49712 AMAZON-02-AmazoncomIncUS South Korea 17->57 file8 process9 file10 47 C:\msys64\dgZU\4asXTC\hIcsl\is-A05C1.tmp, PE32+ 26->47 dropped 49 C:\msys64\dgZU\4asXTC\hIcsl\is-8SAK9.tmp, PE32+ 26->49 dropped 51 C:\msys64\dgZU\4asXTC\hIcsl51kkh.K4n (copy), PE32+ 26->51 dropped 53 2 other malicious files 26->53 dropped 29 4mLv4.exe 26->29         started        process11
Score:
86%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/c5418c52bdf33f70aff9bcf014d3f10c4661a87ff2dbc8747feaa10415fc5e52
Gathering data
Threat name:
Win32.Packed.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-10-31 16:41:31 UTC
File Type:
PE (Exe)
Extracted files:
1136
AV detection:
5 of 36 (13.89%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yvayyuv56m7xbl7zxtybju7rbrdgdkd76ln4q5d75kqqifp4lzja._file
Verdict:
malicious
Label(s):
AntiGravityBackdoor
Create hunting rule
Link:
https://reports.threatray.com/c34e197f-8a19-4677-a130-49c84c4b6572
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery installer privilege_escalation ransomware
Link:
https://tria.ge/reports/261031-t69jssev9q/
Behaviour
Checks SCSI registry key(s)
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Inno Setup is an open-source installation builder for Windows applications.
Enumerates physical storage devices
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Drops file in Windows directory
Enumerates connected drives
Executes dropped EXE
Loads dropped DLL
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c5418c52bdf33f70aff9bcf014d3f10c4661a87ff2dbc8747feaa10415fc5e52

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:MD5_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for MD5 constants
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:WIN_Malware_SalatStealer_ForgeAuto_542e717b
Create hunting rule
Author:Marjoriefort
Description:Detects SalatStealer (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_1762e598_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_2e3a5916_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_2ffc3572
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_30f84f37
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_37b4704b
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_4286e0e1_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_43faefd2
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_5001c94c
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_598a7881_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_74566f98
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_79234c04
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_7e8e91c4
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_92a28498
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_ce8c5b46
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_f1079127
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gh0stRAT

Executable exe c5418c52bdf33f70aff9bcf014d3f10c4661a87ff2dbc8747feaa10415fc5e52

(this sample)

  
Delivery method
Distributed via web download

Comments