MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 e248843812031027dd510d9dadaf973dcf15a1f081fceb39069170f8b2168882. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Gh0stRAT
Vendor detections: 7
| SHA256 hash: | e248843812031027dd510d9dadaf973dcf15a1f081fceb39069170f8b2168882 |
|---|---|
| SHA3-384 hash: | b1087990622f2006b81d1bf1e8f4506b0e1086b1264960c7790c6b82c8489b53bd44b86e0dc8831b6d83549765464ce4 |
| SHA1 hash: | 27990ca7b87ee8f0de27c498d598118830bc26e2 |
| MD5 hash: | adebe32cba2a072790e25d6d8ea87c9f |
| humanhash: | december-purple-ceiling-pluto |
| File name: | SpaceCity.exe |
| Download: | download sample |
| Signature | Gh0stRAT |
| File size: | 793'600 bytes |
| First seen: | 2022-12-16 14:28:46 UTC |
| Last seen: | 2022-12-16 16:36:59 UTC |
| File type: |  exe |
| MIME type: | application/x-dosexec |
| imphash | d13d399db15c51a1337d692663151209 (3 x Gh0stRAT, 1 x Zegost) |
| ssdeep | 12288:zaia+of8EJE4zszA+MkJPSS7lWo/TzHDqsZDD9OItfD5HgHq/lLguf:zaizYtsM6TjDqWDgwfZ8YLguf |
| Threatray | 205 similar samples on MalwareBazaar |
| TLSH | T14EF45A27E3B18BBDC156C13E81A28E19A73FB87D0733C1D745828619EB59AC01F3566E |
| TrID | 59.1% (.SCR) Windows screen saver (13097/50/3) 13.5% (.MZP) WinArchiver Mountable compressed Archive (3000/1) 9.1% (.EXE) OS/2 Executable (generic) (2029/13) 9.0% (.EXE) Generic Win/DOS Executable (2002/3) 9.0% (.EXE) DOS Executable Generic (2000/1) |
| File icon (PE): |  |
| dhash icon | 7b4fcc44361e14a4 (3 x Gh0stRAT, 1 x Zegost) |
| Reporter |  iamdeadlyz |
| Tags: | 45-153-241-207 exe FakeGaliXCity Gh0stRAT SpaceCity |
Iamdeadlyz
From spacecity.games (impersonation of galixcity.io)Taken from: e7f2167e3006889d98d73693be1a1b67ef77359f7850adee8fa079046f0c8c28
Gh0stRAT C&C: 45.153.241.207:1016
Intelligence
File Origin
# of uploads :
2
# of downloads :
195
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
SpaceCity.exe
Verdict:
No threats detected
Analysis date:
2022-12-16 14:30:22 UTC
Tags:
n/a
Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Detection(s):
Result
Verdict:
Clean
Maliciousness:
Behaviour
Searching for the window
Creating a file in the %temp% directory
Creating a window
Result
Malware family:
n/a
Score:
7/10
Tags:
n/a
Behaviour
MalwareBazaar
LanguageCheck
CheckNumberOfProcessor
CheckCmdLine
Verdict:
No Threat
Threat level:
2/10
Confidence:
100%
Tags:
cmd.exe packed
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
52 / 100
Signature
Malicious sample detected (through community Yara rule)
Yara detected Obfuscated Powershell
Behaviour
Behavior Graph:
Detection(s):
Suspicious file
Verdict:
unknown
Similar samples:
+ 195 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
1/10
Tags:
n/a
Behaviour
Suspicious use of WriteProcessMemory
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Unpacked files
SH256 hash:
e248843812031027dd510d9dadaf973dcf15a1f081fceb39069170f8b2168882
MD5 hash:
adebe32cba2a072790e25d6d8ea87c9f
SHA1 hash:
27990ca7b87ee8f0de27c498d598118830bc26e2
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
e7f2167e3006889d98d73693be1a1b67ef77359f7850adee8fa079046f0c8c28
bat Dropped by
SHA256 e7f2167e3006889d98d73693be1a1b67ef77359f7850adee8fa079046f0c8c28
Dropping
SHA256 75a050c99cb24f2bfb3f40502fb960644e7c2f4ed143fdb5479a95a2ad487482
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.