MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d68bd997fea85e2b9e2438e989397798ad214635dd4e43b733214876ac6fa19f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

RunningRAT

Vendor detections: 15

Intelligence 15 IOCs YARA 12 File information Comments

SHA256 hash:	d68bd997fea85e2b9e2438e989397798ad214635dd4e43b733214876ac6fa19f
SHA3-384 hash:	d828437d90729e216d5b5210393cedba475ea1c48ae5146ef02f6f30845863fc790c7373691c00a193d155a7d1d2154c
SHA1 hash:	e132e1b5667f14a545166dbbf91a3a53c9afcd0c
MD5 hash:	4a88c4a8fd4ae358387fe70e97e93a1a
humanhash:	december-don-neptune-speaker
File name:	64.exe
Download:	download sample
Signature	RunningRAT Create hunting rule
File size:	114'688 bytes
First seen:	2026-09-12 13:05:53 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	7e3107c64f6a7a76d8463e3f374f74af (18 x RunningRAT)
ssdeep	1536:vqEA70HzLJksPEOajozLElnqiO2odJ/tHi:vXTLJkQ7zAV3ytC
TLSH	T109B3E542A3E02412E1AF3B74597513364A7D3C795F2582EFF2D5C58E1879AE0AEB070B
TrID	39.7% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13) 21.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 8.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 8.3% (.EXE) Win64 Executable (generic) (6522/11/2) 6.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika	pebin
dhash icon	5c1ca8ace458e832 (6 x RunningRAT, 1 x CoinMiner)
Reporter	abuse_ch
Tags:	exe RAT RunningRAT

Intelligence

File Origin

# of uploads :

# of downloads :

146

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

Gh0stRat

Details

Link:

https://research.acce.ciphertechsolutions.com/results/90b04510-d0f3-4084-b69f-d6283227701e/

Malware family:

n/a

ID:

File name:

exe

Verdict:

Suspicious activity

Analysis date:

2026-09-12 13:09:29 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/a8307ab9-5845-4822-83d8-9c6740658db4

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

RunningRAT

Link:

https://www.capesandbox.com/analysis/85157/

Detection(s):

Win.Dropper.Gh0stRAT-6997745-0

Win.Dropper.Gh0stRAT-7752666-0

Win.Malware.Siscos-9949387-0

ditekSHen.MALWARE.Win.Trojan.RunningRAT.UNOFFICIAL

Verdict:

Malicious

Labled as:

Trojan.Siscos

Link:

https://www.hybrid-analysis.com/sample/d68bd997fea85e2b9e2438e989397798ad214635dd4e43b733214876ac6fa19f

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-09-12T09:31:00Z UTC

Last seen:

2026-09-12T14:48:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/d68bd997fea85e2b9e2438e989397798ad214635dd4e43b733214876ac6fa19f/results?tab=lookup

Malware family:

KuaiGoMiner

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/4e906ef0-8fe0-4b75-95e2-c864b6605aa7

Result

Threat name:

Gh0stCringe, RunningRAT

Detection:

malicious

Classification:

bank.troj.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1972241

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

C2 URLs / IPs found in malware configuration

Checks if browser processes are running

Creates a Windows Service pointing to an executable in C:\Windows

Drops executables to the windows directory (C:\Windows) and starts them

Found evasive API chain (may stop execution after checking mutex)

Found malware configuration

Found stalling execution ending in API Sleep call

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Performs DNS queries to domains with low reputation

Self deletion via cmd or bat file

Suricata IDS alerts for network traffic

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Yara detected Gh0stCringe

Yara detected RunningRAT

Behaviour

Behavior Graph:

Download SVG

Score:

90%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/d68bd997fea85e2b9e2438e989397798ad214635dd4e43b733214876ac6fa19f

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 32 Exe x86

Link:

https://app.malva.re/file/4a88c4a8fd4ae358387fe70e97e93a1a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d68bd997fea85e2b9e2438e989397798ad214635dd4e43b733214876ac6fa19f/

Threat name:

Win32.Backdoor.Venik

Status:

Malicious

First seen:

2026-09-12 12:56:37 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

33 of 36 (91.67%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=22f5tf76vbpcxhrehduysolxtcwscrrv3vhehnztefehnldpugpq._file

Verdict:

malicious

Label(s):

YoungLotus

Link:

https://reports.threatray.com/eafc2a97-17f9-4255-9566-2b2371098a2a

Gathering data

Unpacked files

SH256 hash:

d68bd997fea85e2b9e2438e989397798ad214635dd4e43b733214876ac6fa19f

MD5 hash:

4a88c4a8fd4ae358387fe70e97e93a1a

SHA1 hash:

e132e1b5667f14a545166dbbf91a3a53c9afcd0c

Detections:

win_runningrat_w0

Link:

https://www.unpac.me/results/fd6b1d3e-cf9f-43ea-8dec-79fa56726c09/

SH256 hash:

1e6ee2095c2f61c21e4f3de829804136122b209b97c88f02ff6a1f52b1a33a40

MD5 hash:

d223a2349409648ceafa8d428603adcf

SHA1 hash:

4e365466dab9dc42bf02c7392462ff7488a230c7

Detections:

win_younglotus_g0

MALWARE_Win_RunningRAT

Link:

https://www.unpac.me/results/fd6b1d3e-cf9f-43ea-8dec-79fa56726c09/

Malware family:

GoldDragon

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/d68bd997fea8/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d68bd997fea85e2b9e2438e989397798ad214635dd4e43b733214876ac6fa19f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CMD_Ping_Localhost Create hunting rule

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	GoldDragon_RunningRAT Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Running RAT from Gold Dragon report
Reference:	https://goo.gl/rW1yvZ

Rule name:	GoldDragon_RunningRAT_RID2F19 Create hunting rule
Author:	Florian Roth
Description:	Detects Running RAT from Gold Dragon report
Reference:	https://goo.gl/rW1yvZ

Rule name:	MALWARE_Win_RunningRAT Create hunting rule
Author:	ditekSHen
Description:	Detects RunningRAT

Rule name:	SUSP_Reverse_DOS_header Create hunting rule
Author:	SECUINFRA Falcon Team
Description:	Detects an reversed DOS header

Rule name:	Typical_Malware_String_Transforms Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects typical strings in a reversed or otherwise modified form
Reference:	Internal Research

Rule name:	Typical_Malware_String_Transforms_RID3473 Create hunting rule
Author:	Florian Roth
Description:	Detects typical strings in a reversed or otherwise modified form
Reference:	Internal Research

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

Rule name:	win_runningrat_w0 Create hunting rule
Author:	Florian Roth

Rule name:	ZxShell_Related_Malware_CN_Group_Jul17_1 Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects a ZxShell related sample from a CN threat group
Reference:	https://blogs.rsa.com/cat-phishing/

Rule name:	ZxShell_Related_Malware_CN_Group_Jul17_1_RID3601 Create hunting rule
Author:	Florian Roth
Description:	Detects a ZxShell related sample from a CN threat group
Reference:	https://blogs.rsa.com/cat-phishing/