MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d5b97d4be78dd6e6795c7e5376faeeaa58ac0b40629ea67291f223d42f19553a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gh0stRAT

Vendor detections: 15

Intelligence 15 IOCs YARA 13 File information Comments 1

SHA256 hash:	d5b97d4be78dd6e6795c7e5376faeeaa58ac0b40629ea67291f223d42f19553a
SHA3-384 hash:	a30ca726ec87d38715378f56c5183a242bf0310a19ed174399151e5028fee3ccf29e2d142874071ce241fbef8f49b109
SHA1 hash:	dd458c13a78c720e11673e65c9671bf22ad2ec2f
MD5 hash:	01008eecc7f13949ab694c4b30acfc88
humanhash:	ack-saturn-nebraska-sodium
File name:	01008eecc7f13949ab694c4b30acfc88
Download:	download sample
Signature	Gh0stRAT Create hunting rule
File size:	4'655'104 bytes
First seen:	2024-06-25 05:24:58 UTC
Last seen:	2024-06-25 06:45:44 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	37f075af0be292eecc79e56533b278b2 (2 x Gh0stRAT)
ssdeep	98304:1JeVusCcg53j1qLd9z/Wro8xSFfsGegFLOAkGkzdnEVomFHKnPs:/shG3Q+o8xSFEGegFLOyomFHKnPs
Threatray	18 similar samples on MalwareBazaar
TLSH	T1192659197E5C0C29CA52D332C544E1E79DE9EFE0952F83929988FB9D5030643FCA64BE
TrID	68.8% (.CPL) Windows Control Panel Item (generic) (57583/11/19) 12.5% (.EXE) Win64 Executable (generic) (10523/12/4) 6.0% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.3% (.EXE) Win32 Executable (generic) (4504/4/1) 2.4% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	787c78fa87f7e6c4 (16 x Gh0stRAT, 11 x Pikabot, 9 x ManusCrypt)
Reporter	zbetcheckin
Tags:	32 exe Gh0stRAT

Intelligence

File Origin

# of uploads :

# of downloads :

319

Origin country :

Vendor Threat Intelligence

Malware family:

gh0st

ID:

File name:

d5b97d4be78dd6e6795c7e5376faeeaa58ac0b40629ea67291f223d42f19553a.exe

Verdict:

Malicious activity

Analysis date:

2024-06-25 05:27:53 UTC

Tags:

remote rat gh0st sainbox backdoor

Link:

https://app.any.run/tasks/03b48b26-d73a-4ddb-bbaf-83df1b094a4f

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

SecuriteInfo.com.Trojan.Siggen28.31518.27987.15300.UNOFFICIAL

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=667a54b08bee61523c5d2155win7simulatehigh_evasion

Tags:

Encryption Execution Network Static

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating a file in the Program Files subdirectories

Enabling the 'hidden' option for recently created files

Creating a service

Launching a service

Creating a process from a recently created file

Searching for synchronization primitives

Launching cmd.exe command interpreter

Creating a process with a hidden window

Launching a process

Creating a file

Сreating synchronization primitives

DNS request

Connection attempt

Searching for the window

Sending a custom TCP request

Enabling autorun for a service

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

fingerprint keylogger lolbin microsoft_visual_cc packed shell32

Link:

https://www.filescan.io/uploads/667a54b20bf5978c0b1224ab/reports/4a46c0e8-c03c-4e69-9871-634a3d69516c/overview

Verdict:

Malicious

Labled as:

Zusy.Generic

Link:

https://www.hybrid-analysis.com/sample/d5b97d4be78dd6e6795c7e5376faeeaa58ac0b40629ea67291f223d42f19553a

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/4f2d34fe-691b-42d7-9ab3-08267537b0dc

Result

Threat name:

GhostRat, Mimikatz

Detection:

malicious

Classification:

bank.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1462155

Signature

AI detected suspicious sample

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Checks if browser processes are running

Contains functionality to access PhysicalDrive, possible boot sector overwrite

Contains functionality to automate explorer (e.g. start an application)

Contains functionality to capture and log keystrokes

Contains functionality to detect sleep reduction / modifications

Contains functionality to infect the boot sector

Found evasive API chain (may stop execution after checking mutex)

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Yara detected GhostRat

Yara detected Mimikatz

Behaviour

Behavior Graph:

Download SVG

Score:

92%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/d5b97d4be78dd6e6795c7e5376faeeaa58ac0b40629ea67291f223d42f19553a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d5b97d4be78dd6e6795c7e5376faeeaa58ac0b40629ea67291f223d42f19553a/

Threat name:

Win32.Backdoor.Farfli

Status:

Malicious

First seen:

2024-06-24 16:56:26 UTC

File Type:

PE (Exe)

Extracted files:

823

AV detection:

23 of 24 (95.83%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=2w4x2s7hrxlom6k4pzjxn6xovjmkyc2amkpkm4ur6ir5ilyzku5a._file

Verdict:

malicious

Gh0stRAT

34c9f3d0e2c4772ca97819e9080dcb10673790f7b3778a598118dfd141fd14e2

Gh0stRAT

3ef14f469d7554de72cb7845067af1ae991ed2114d09ba6f4e913787f24c61c1

Gh0stRAT

e1f3874c42cdd4e2c49477d7b2bc3ebd3bcd4e3a2cf882fa4d1ea09546c74f5d

Gh0stRAT

f9b9034411d8190fafa5592aacd427fbf49c21eeda708b4675aa72d71bc37f21

Gh0stRAT

+ 8 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

7/10

Tags:

n/a

Link:

https://tria.ge/reports/240625-f4ae2awbnj/

Behaviour

Checks processor information in registry

Modifies data under HKEY_USERS

Runs ping.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Drops file in Program Files directory

Enumerates connected drives

Deletes itself

Executes dropped EXE

Loads dropped DLL

Unpacked files

SH256 hash:

db02bd03b54cd2fd7d525612ba1841d1eefde56cbb8bb5f364b659ef14067213

MD5 hash:

6abe001711095d8dcfbcdd6a509ed8bd

SHA1 hash:

e56e2f9c58fee2c8fd3233f8464fb52c7641ad4d

Detections:

INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess

MALWARE_Win_FatalRAT

check_installed_software

Mimikatz_Strings

MALWARE_Win_PCRat

MALWARE_Win_Zegost

Link:

https://www.unpac.me/results/dcf321e4-fb8e-4985-a32d-70020e6bfa80/

Parent samples :

0e022e4338e1650d82a719b009c4aa7bd5efa43e72518e0395777d0be37ec04b
d5b97d4be78dd6e6795c7e5376faeeaa58ac0b40629ea67291f223d42f19553a
5c86a4498bc05f88149ad40cc97ae4584a769840e8fb259a2bd2b3bf07d96919
0d5fd3da00f55402d3a66a8dd9f005b30d541cf2504073bc61c9ab260dccc4f0
0df117613af0902c70b911dfac2ee615177502036b2335490417aee11db9dfed
0271dce68b059c6996c2af61298a54b5dac89d9b4a76e4849e715ccaf7466dc9
d71bb15d343dd91690efb049eba30f28aecc17500bd2deb7204f48282e45576e
4cf92b27d387c9f3aaee9bc12de4eb22f2e8a6b6179affc4575a5d778cee173b
6d0d5b0d4b6a0c4a99f227d38bfe87bd10079034bbd41c90c34a8244aab55a84
481f80be12bf59f0f7a813410241e9101d68725e7e5e9dd0caede8709c5a75c9
a81700bf767bd7c4ee3ba71c954ad1bc37b89818a8953466bb7d858f8a4d26bd
b642e6abf52baf150f8f06464a4f43fe8c86b984a859a20ba096e2dc950e4bf6
aa9380ebe4adbb984507dacb82fc077026f2ebd0535af216a6569b04ce9d3efe
5e189d616ee4fe528bc165b7528b071619408d43bbfd9c82c045aeeb55276478
68d0d7937388b70590892bd45e375a3986986abba5bfaf6071df495bd5978bc6
39de176c5876211820f2a565b740fdbb716cb0c9a27798732a9beeddef32b509
c9fc0c580e2cd2e376e7103422b581255da63295b94a96cd9121afa467a6583a
e341ad06bffac6637eceabcca1809cb2cb0378a4a02a0deb60c6be8536e97d81
6fddee12262f702de7ff59bf6a8178069576ae4ca57eae62d9d3c7cfb3814a53
8d2e9aa524bd78eb971e05a03741b92be58b52d9b7e4693896b2f3820d2fa683
0a6308c3c221fba00a3d53e944f515a00eb348187117828aa5ae59db36ee2a10
f980a395b1d3f5a2a4720e6cd57edaf5819105af9d9bb153e6a854dad0aa5659
9408a7c93e8115afe26a6a12e8bfce35d741cdc890ee2d08b7dba9eb6bacdde1
eb689bd8c8fe09a6e4e2e5b41cb3c4538c64bc5ef92938480646d10685db6e67

SH256 hash:

d5b97d4be78dd6e6795c7e5376faeeaa58ac0b40629ea67291f223d42f19553a

MD5 hash:

01008eecc7f13949ab694c4b30acfc88

SHA1 hash:

dd458c13a78c720e11673e65c9671bf22ad2ec2f

Link:

https://www.unpac.me/results/dcf321e4-fb8e-4985-a32d-70020e6bfa80/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d5b97d4be78dd6e6795c7e5376faeeaa58ac0b40629ea67291f223d42f19553a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Armadillov1xxv2xx Create hunting rule
Author:	malware-lu

Rule name:	Check_OutputDebugStringA_iat Create hunting rule

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess Create hunting rule
Author:	ditekSHen
Description:	Detects executables calling ClearMyTracksByProcess

Rule name:	maldoc_getEIP_method_1 Create hunting rule
Author:	Didier Stevens (https://DidierStevens.com)

Rule name:	MALWARE_Win_FatalRAT Create hunting rule
Author:	ditekSHen
Description:	Detects FatalRAT

Rule name:	MALWARE_Win_PCRat Create hunting rule
Author:	ditekSHen
Description:	Detects PCRat / Gh0st

Rule name:	MALWARE_Win_Zegost Create hunting rule
Author:	ditekSHen
Description:	Detects Zegost

Rule name:	meth_get_eip Create hunting rule
Author:	Willi Ballenthin

Rule name:	Mimikatz_Strings Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Mimikatz strings
Reference:	not set

Rule name:	Mimikatz_Strings_RID2DA0 Create hunting rule
Author:	Florian Roth
Description:	Detects Mimikatz strings
Reference:	not set

Rule name:	Windows_Trojan_Gh0st_ee6de6bc Create hunting rule
Author:	Elastic Security
Description:	Identifies a variant of Gh0st Rat

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Gh0stRAT

exe d5b97d4be78dd6e6795c7e5376faeeaa58ac0b40629ea67291f223d42f19553a

(this sample)

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/2905156/

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings

ID	Title	Severity
CHECK_AUTHENTICODE	Missing Authenticode	high
CHECK_DLL_CHARACTERISTICS	Missing dll Security Characteristics (HIGH_ENTROPY_VA)	high
CHECK_TRUST_INFO	Requires Elevated Execution (level:requireAdministrator)	high

Reviews

ID	Capabilities	Evidence
COM_BASE_API	Can Download & Execute components	ole32.dll::CLSIDFromProgID ole32.dll::CoCreateInstance ole32.dll::CoFreeUnusedLibraries ole32.dll::CreateStreamOnHGlobal
GDI_PLUS_API	Interfaces with Graphics	gdiplus.dll::GdiplusStartup gdiplus.dll::GdiplusShutdown gdiplus.dll::GdipDeleteGraphics gdiplus.dll::GdipAlloc gdiplus.dll::GdipCreateFromHDC
MULTIMEDIA_API	Can Play Multimedia	WINMM.dll::PlaySoundA
SHELL_API	Manipulates System Shell	SHELL32.dll::ShellExecuteA SHELL32.dll::SHGetFileInfoA
WIN32_PROCESS_API	Can Create Process and Threads	KERNEL32.dll::CloseHandle KERNEL32.dll::CreateThread
WIN_BASE_API	Uses Win Base API	KERNEL32.dll::TerminateProcess KERNEL32.dll::LoadLibraryW KERNEL32.dll::LoadLibraryA KERNEL32.dll::LoadLibraryExW KERNEL32.dll::GetVolumeInformationA KERNEL32.dll::GetSystemInfo
WIN_BASE_EXEC_API	Can Execute other programs	KERNEL32.dll::WriteConsoleW KERNEL32.dll::ReadConsoleW KERNEL32.dll::SetStdHandle KERNEL32.dll::GetConsoleCP KERNEL32.dll::GetConsoleMode
WIN_BASE_IO_API	Can Create Files	KERNEL32.dll::CopyFileA KERNEL32.dll::CreateFileW KERNEL32.dll::CreateFileA KERNEL32.dll::DeleteFileA SHLWAPI.dll::PathRemoveFileSpecW KERNEL32.dll::GetWindowsDirectoryA
WIN_REG_API	Can Manipulate Windows Registry	ADVAPI32.dll::RegCreateKeyExA ADVAPI32.dll::RegDeleteKeyA ADVAPI32.dll::RegOpenKeyExA ADVAPI32.dll::RegQueryValueA ADVAPI32.dll::RegQueryValueExA ADVAPI32.dll::RegSetValueExA
WIN_USER_API	Performs GUI Actions	USER32.dll::AppendMenuA USER32.dll::CreateMenu ole32.dll::OleCreateMenuDescriptor USER32.dll::EmptyClipboard USER32.dll::OpenClipboard USER32.dll::PeekMessageA

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2024-06-25 05:24:59 UTC

url : hxxp://45.207.168.120:7744/k7.exe