🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e33747bc8c4c2a09846c4bd73fe9cd67eff2cef9a9be1a1f3fade6964d644b18. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gh0stRAT


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e33747bc8c4c2a09846c4bd73fe9cd67eff2cef9a9be1a1f3fade6964d644b18
SHA3-384 hash: 4d9f2cc91e7794d53834f1968b4d34dc043abbb2d2d88f3e97257618caf447c1262651f684a35bb53d1dbf85c785f9f9
SHA1 hash: 5b01b33674fc1a59cee135a9c5b65bd3d07e1e23
MD5 hash: f0fdecccb1abbd0ebc99d09448202f34
humanhash: social-arizona-east-neptune
File name:03df2f_x86_exe.bin
Download: download sample
Signature Gh0stRAT
Create hunting rule
File size:36'864 bytes
First seen:2026-10-12 22:33:29 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 340026c2a99ff022ef9842ce1e43801e (1 x Blackmoon, 1 x Gh0stRAT)
ssdeep 768:+mfjwQzmBOYMZeQEDNpPv0c3q7QZJxhJAUn4l11tPq:+mjzm8vzsEZaJxhGU4Bx
TLSH T154F27C47BA4AD4B6F61114B8086E37BAD177CE74E301A2938F70DC6540B220AFD7A58B
TrID 39.7% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
21.0% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
8.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
8.3% (.EXE) Win64 Executable (generic) (6522/11/2)
6.4% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
Reporter Daydream
Tags:Blackmoon exe Gh0stRAT launcher


Avatar
Daydream
36,864-byte launcher stored twice inside 445.jpg, compiled 2024-06-10; earlier build of 508cacc6d7661eb154dcd6f3e23aef48d7153245dc88482c55fe46b78536ed5f. Part of the Blackmoon-based toolkit served from down.ftp21.cc (Rapid7, 13 July 2023, describes the 2023 builds). Static analysis only; not executed by us.

Intelligence

File Origin
# of uploads :
1
# of downloads :
219
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
No threats detected
Analysis date:
2026-10-12 22:43:43 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/fcb2b28d-f1ea-47ee-9de2-876f76d906a9

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/91604/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader47.952.UNOFFICIAL
Create hunting rule

Gathering data
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating synchronization primitives
Creating a window
Connection attempt to an infection source
Sending a custom TCP request
Query of malicious DNS domain
Sending a TCP request to an infection source
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
crypto evasive farfli masquerade microsoft_visual_cc reconnaissance redosdru
Link:
https://www.filescan.io/uploads/6acd60668099a48155aae670/reports/d4131225-182b-47de-8a91-0c92c9263aca/overview
Verdict:
Malicious
Labled as:
Trojan.Generic
Link:
https://www.hybrid-analysis.com/sample/e33747bc8c4c2a09846c4bd73fe9cd67eff2cef9a9be1a1f3fade6964d644b18
Verdict:
Malicious
File Type:
exe x32
First seen:
2024-06-11T01:49:00Z UTC
Last seen:
2026-10-13T18:34:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/e33747bc8c4c2a09846c4bd73fe9cd67eff2cef9a9be1a1f3fade6964d644b18/results?tab=lookup
Gathering data
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/e33747bc8c4c2a09846c4bd73fe9cd67eff2cef9a9be1a1f3fade6964d644b18
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/f0fdecccb1abbd0ebc99d09448202f34
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e33747bc8c4c2a09846c4bd73fe9cd67eff2cef9a9be1a1f3fade6964d644b18/
Threat name:
Win32.Trojan.Redosdru
Create hunting rule
Status:
Malicious
First seen:
2024-06-11 14:14:53 UTC
File Type:
PE (Exe)
AV detection:
29 of 36 (80.56%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4m3uppemjqvatbdmjplt72onm7x7ftxzvg7buhz7vxtjmtlejmma._file
Result
Malware family:
gh0strat
Create hunting rule
Score:
  10/10
Tags:
family:gh0strat discovery rat
Link:
https://tria.ge/reports/261012-2g7ynsbx4q/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Enumerates physical storage devices
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Unexpected DNS network traffic destination
Unpacked files
SH256 hash:
e33747bc8c4c2a09846c4bd73fe9cd67eff2cef9a9be1a1f3fade6964d644b18
MD5 hash:
f0fdecccb1abbd0ebc99d09448202f34
SHA1 hash:
5b01b33674fc1a59cee135a9c5b65bd3d07e1e23
Link:
https://www.unpac.me/results/a63ba626-5532-4d49-99b4-f9b9b4bbc05b/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e33747bc8c4c2a09846c4bd73fe9cd67eff2cef9a9be1a1f3fade6964d644b18

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Blackmoon

Executable exe 9591e4d1090bc5caa1d1db4ebf929d9113fd36e0521d316762f5cff275b4c733

Gh0stRAT

Executable exe e33747bc8c4c2a09846c4bd73fe9cd67eff2cef9a9be1a1f3fade6964d644b18

(this sample)

  
Dropped by
SHA256 9591e4d1090bc5caa1d1db4ebf929d9113fd36e0521d316762f5cff275b4c733
  
Delivery method
Other
  
URLhaus
https://urlhaus.abuse.ch/url/2932460/
Cape
Cape
https://www.capesandbox.com/analysis/91604/

Comments