MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 e046697b4102be8e3ad4b6e04524e7248d86b58f6d9f4884357fd33768878fbd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Gh0stRAT
Vendor detections: 11
| SHA256 hash: | e046697b4102be8e3ad4b6e04524e7248d86b58f6d9f4884357fd33768878fbd |
|---|---|
| SHA3-384 hash: | 3fcf80ab49931b5e6b1c1648a83a79cc326bffe294963f83a37809f2f844316ef7638ded9a66d56d1299fda534d3e2e5 |
| SHA1 hash: | bfe458f254485358a5eb2e8a830818f9219c0a83 |
| MD5 hash: | 6622363be06db7fabf23393755e05b0b |
| humanhash: | sink-bravo-avocado-kitten |
| File name: | 6622363be06db7fabf23393755e05b0b |
| Download: | download sample |
| Signature | Gh0stRAT |
| File size: | 85'504 bytes |
| First seen: | 2021-09-13 08:55:27 UTC |
| Last seen: | Never |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | 4a808dc3f3a9b0712288dfa8c7e7e8a4 (4 x Gh0stRAT) |
| ssdeep | 1536:59POZTDTDXAqlscUaXzvFMHmx7HHZsj8U4n43HTdk0GVj+Bk4:HPmTXDXAdEzmGBH5uHTddG4 |
| Threatray | 1 similar samples on MalwareBazaar |
| TLSH | T1DD8301CCB3380D45F8E24CB3122B97225935B93827E1D57D50ADE2A62DBA4D2AC21797 |
| Reporter |  zbetcheckin |
| Tags: | 32 exe Gh0stRAT |
Intelligence
File Origin
# of uploads :
1
# of downloads :
158
Origin country :
n/a
Vendor Threat Intelligence
Detection:
Backdoor
Result
Verdict:
Malware
Maliciousness:
Behaviour
Creating a service
Creating a file in the %temp% directory
Moving a file to the system32 directory
Launching a service
Deleting a system file
Replacing system files
Connection attempt
Sending a custom TCP request
Enabling autorun for a service
Deleting of the original file
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Tags:
backdoor greyware obfuscated packed zxshell
Malware family:
Gh0st RAT
Verdict:
Malicious
Result
Threat name:
GhostRat
Detection:
malicious
Classification:
troj.evad
Score:
96 / 100
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Contains functionality to detect sleep reduction / modifications
Creates a Windows Service pointing to an executable in C:\Windows
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected GhostRat
Behaviour
Behavior Graph:
Threat name:
Win32.Backdoor.PcClient
Status:
Malicious
First seen:
2021-09-09 05:26:00 UTC
AV detection:
27 of 27 (100.00%)
Threat level:
5/5
Detection(s):
Suspicious file
Verdict:
malicious
Result
Malware family:
n/a
Score:
10/10
Tags:
bootkit persistence suricata upx
Behaviour
Checks processor information in registry
Modifies data under HKEY_USERS
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Drops file in System32 directory
Writes to the Master Boot Record (MBR)
Deletes itself
Loads dropped DLL
Sets DLL path for service in the registry
suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic
suricata: ET MALWARE Backdoor family PCRat/Gh0st CnC traffic (OUTBOUND) 102
Unpacked files
SH256 hash:
eb7a39e0711c3fc132d19aa6acb4768321527cda8f6d8156d7ce87315aae2f72
MD5 hash:
b61536d9710e95287ad985243bae9db5
SHA1 hash:
e08d3e6eacaa7741917a7f015cd77fb2d150768c
SH256 hash:
948cd478737ca1bc7af7a1673ae596e87c03a5cdb0748eec1dcd717ceaa57167
MD5 hash:
e3fc658f80eacaed04b949ba15e92007
SHA1 hash:
cdf11b772a0ed0f89fc1a307b30cc84e92bb7b0e
SH256 hash:
e046697b4102be8e3ad4b6e04524e7248d86b58f6d9f4884357fd33768878fbd
MD5 hash:
6622363be06db7fabf23393755e05b0b
SHA1 hash:
bfe458f254485358a5eb2e8a830818f9219c0a83
Malware family:
ZxShell
Verdict:
Malicious
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Backdoor
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.url : hxxp://1.14.61.188/pay.exe