MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d727f725ef0c3837013468f9675b6a0531658d8e60f01e5762e130cbabd665d0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Gh0stRAT

Vendor detections: 16

Intelligence 16 IOCs YARA 9 File information Comments

SHA256 hash:	d727f725ef0c3837013468f9675b6a0531658d8e60f01e5762e130cbabd665d0
SHA3-384 hash:	f595b1bde7c39cbb63936a226e38a6377105eb6ce859ad79464b938eff4415ee75f51b3d5c39321f690e0908cb479700
SHA1 hash:	54f786fe53655ac3c1c68d64c9bd60101edf9b33
MD5 hash:	66f09c4ebbb85dedd40df72a213f21cc
humanhash:	solar-winter-missouri-pizza
File name:	66f09c4ebbb85dedd40df72a213f21cc.exe
Download:	download sample
Signature	Gh0stRAT Create hunting rule
File size:	227'012 bytes
First seen:	2023-02-27 19:46:03 UTC
Last seen:	2023-02-27 21:28:51 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	b0b4670bf0c3c7cfd12141d213d0feed (1 x Gh0stRAT)
ssdeep	6144:+aeRQcV+C6rUsQ47cOu0X7mVHKTmjysSfZ3cXozMR:/TcVMrUmuImVHYmMf6Uu
TLSH	T1142412A9DBE71BEDF621143880A763506E111D16B1E3AECB27417DBF0E743A4EC114EA
TrID	27.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 20.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 18.6% (.EXE) Win32 Executable (generic) (4505/5/1) 8.5% (.ICL) Windows Icons Library (generic) (2059/9) 8.3% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):
dhash icon	c7c75b258d2555df (1 x Gh0stRAT)
Reporter	abuse_ch
Tags:	exe Gh0stRAT

abuse_ch

Gh0stRAT C2:
58.221.57.142:7777

Intelligence

File Origin

# of uploads :

# of downloads :

217

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

pcrat

ID:

File name:

66f09c4ebbb85dedd40df72a213f21cc.exe

Verdict:

Malicious activity

Analysis date:

2023-02-27 19:49:07 UTC

Tags:

trojan rat pcrat gh0st

Link:

https://app.any.run/tasks/93bad3ed-b2d5-4e2a-9c02-f1b8c9c3d889

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

Zegost

Link:

https://www.capesandbox.com/analysis/370412/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Sending a custom TCP request

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

farfli packed shell32.dll

Link:

https://www.filescan.io/uploads/63fd087e0796d7d621e9020f/reports/1eb81a4a-873d-4c56-b4fe-f92e1c239aa9/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_100%

Link:

https://www.hybrid-analysis.com/sample/d727f725ef0c3837013468f9675b6a0531658d8e60f01e5762e130cbabd665d0

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Malware family:

Malicious Packer

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/64d3aa04-a675-4b39-8050-c43dccb0bccd

Result

Threat name:

GhostRat, Mimikatz, Nitol

Detection:

malicious

Classification:

bank.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1183528

Signature

Checks if browser processes are running

Contains functionality to automate explorer (e.g. start an application)

Contains functionality to capture and log keystrokes

Contains functionality to detect sleep reduction / modifications

Contains functionality to detect virtual machines (IN, VMware)

Contains functionality to infect the boot sector

Contains functionality to modify windows services which are used for security filtering and protection

Found evasive API chain (may stop execution after checking mutex)

Found stalling execution ending in API Sleep call

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Yara detected GhostRat

Yara detected Mimikatz

Yara detected Nitol

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d727f725ef0c3837013468f9675b6a0531658d8e60f01e5762e130cbabd665d0/

Threat name:

Win32.Backdoor.Farfli

Status:

Malicious

First seen:

2023-02-23 13:41:00 UTC

File Type:

PE (Exe)

Extracted files:

AV detection:

28 of 38 (73.68%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=24t7ojppbq4doajund4wow3kauywldmomdyb4v3c4eymxk6wmxia._file

Verdict:

malicious

Result

Malware family:

gh0strat

Score:

10/10

Tags:

family:gh0strat rat

Link:

https://tria.ge/reports/230227-yg1b2sfb8t/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Enumerates connected drives

Gh0st RAT payload

Gh0strat

Unpacked files

SH256 hash:

31913b545d5634caaa1a8c8f6631fc795bdb063226360edd959d0e609bbfb270

MD5 hash:

2a21c07fbd78ce1f06c1a5f4f9696aa2

SHA1 hash:

ad4b952f5fa8e6b5a792d9d864da63b5bd5bbfc0

Link:

https://www.unpac.me/results/57c63fe5-ed9b-43dd-aa78-f270136291ba/

Parent samples :

21a29333d1257e28e71774f939f0569830bcde339784ab04de0a5f8b937b1b1d
ab605210ed213b2dcda4fef16edcbce08700922f0e503282d40bdf0beaffb6d6

SH256 hash:

d727f725ef0c3837013468f9675b6a0531658d8e60f01e5762e130cbabd665d0

MD5 hash:

66f09c4ebbb85dedd40df72a213f21cc

SHA1 hash:

54f786fe53655ac3c1c68d64c9bd60101edf9b33

Link:

https://www.unpac.me/results/57c63fe5-ed9b-43dd-aa78-f270136291ba/

Malware family:

Mimikatz

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/d727f725ef0c/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Backdoor

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d727f725ef0c3837013468f9675b6a0531658d8e60f01e5762e130cbabd665d0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	GhostDragon_Gh0stRAT Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Gh0st RAT mentioned in Cylance' Ghost Dragon Report
Reference:	https://blog.cylance.com/the-ghost-dragon

Rule name:	INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess Create hunting rule
Author:	ditekSHen
Description:	Detects executables calling ClearMyTracksByProcess

Rule name:	MALWARE_Win_PCRat Create hunting rule
Author:	ditekSHen
Description:	Detects PCRat / Gh0st

Rule name:	MALWARE_Win_Zegost Create hunting rule
Author:	ditekSHen
Description:	Detects Zegost

Rule name:	meth_get_eip Create hunting rule
Author:	Willi Ballenthin

Rule name:	meth_stackstrings Create hunting rule
Author:	Willi Ballenthin

Rule name:	Mimikatz_Strings Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects Mimikatz strings
Reference:	not set

Rule name:	Mimikatz_Strings_RID2DA0 Create hunting rule
Author:	Florian Roth
Description:	Detects Mimikatz strings
Reference:	not set

Rule name:	Windows_Trojan_Gh0st_ee6de6bc Create hunting rule
Author:	Elastic Security
Description:	Identifies a variant of Gh0st Rat

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/370412/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample