MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eaa840e393c8f8a3bdcd865ea6eff59f586e14bd9c3518d88098062056964281. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	eaa840e393c8f8a3bdcd865ea6eff59f586e14bd9c3518d88098062056964281
SHA3-384 hash:	ec3596970cbe58bd419812e2c58526baaa7ad1cad484628708a035471b2c24d588cb68efbad51019718c6ffd7408d5cf
SHA1 hash:	834d5d05d7361412dada35950e98fbedef66d7e3
MD5 hash:	7aad7c8ad75a96d9dd0f32ae5b51aca7
humanhash:	triple-minnesota-winner-eleven
File name:	7aad7c8ad75a96d9dd0f32ae5b51aca7
Download:	download sample
Signature	Gh0stRAT Alert Create hunting rule
File size:	1'242'112 bytes
First seen:	2023-12-31 23:59:20 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	de6942886ea1706308de6a5dc748b51c (8 x Gh0stRAT)
ssdeep	12288:zcWl26g/UBlRn5DzZ3TTP+5WkOVHK/H7sx117ksgSh20RUTMkzVSleJHcT/rBMSi:gWgHN8kSszVSlMHcTDBMGr9chBMNk
TLSH	T1B94559691BAB4256DB553BB9C8B6929409190F531F28C4B16E310D1EBD2724FFC23EBC
TrID	40.5% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 16.1% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 12.3% (.EXE) Win16 NE executable (generic) (5038/12/1) 11.0% (.EXE) Win32 Executable (generic) (4505/5/1) 5.0% (.ICL) Windows Icons Library (generic) (2059/9)
Reporter	zbetcheckin
Tags:	32 exe Gh0stRAT

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

396

Origin country :

FR

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Win.Trojan.Killmbr-9972958-0

Alert

Create hunting rule

Dr. Web vxCube Malware

Result

Verdict:

Malware

Maliciousness:

Behaviour

Searching for the window

Сreating synchronization primitives

Sending a custom TCP request

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

farfli packed virus

Link:

https://www.filescan.io/uploads/659200846b1c24604613367d/reports/924692e4-9b65-4095-ab20-124ddf9acb2a/overview

Hybrid Analysis DeepScan:Generic.KillMBR.A

Verdict:

Malicious

Labled as:

DeepScan:Generic.KillMBR.A

Link:

https://www.hybrid-analysis.com/sample/eaa840e393c8f8a3bdcd865ea6eff59f586e14bd9c3518d88098062056964281

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Intezer Generic Malware

Malware family:

Generic Malware

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/ce4fad71-5168-4800-a9e5-15acf4b90eb4

Joe Sandbox GhostRat, Nitol

Result

Threat name:

GhostRat, Nitol

Alert

Create hunting rule

Detection:

malicious

Classification:

bank.troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1368442

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

C2 URLs / IPs found in malware configuration

Checks if browser processes are running

Contains functionality to automate explorer (e.g. start an application)

Contains functionality to detect sleep reduction / modifications

Contains functionality to infect the boot sector

Contains functionality to modify clipboard data

Contains functionality to modify windows services which are used for security filtering and protection

Found evasive API chain (may stop execution after checking mutex)

Found malware configuration

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected GhostRat

Yara detected Nitol

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/eaa840e393c8f8a3bdcd865ea6eff59f586e14bd9c3518d88098062056964281

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/eaa840e393c8f8a3bdcd865ea6eff59f586e14bd9c3518d88098062056964281/

ReversingLabs TitaniumCloud Win32.Backdoor.Farfli

Threat name:

Win32.Backdoor.Farfli

Alert

Create hunting rule

Status:

Malicious

First seen:

2023-12-25 07:44:02 UTC

File Type:

PE (Exe)

AV detection:

32 of 36 (88.89%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5kueby4tzd4khponqzpkn37vt5mg4ff5tq2rrweatadcavuwikaq._file

Threatray malicious

Verdict:

malicious

Hatching Triage purplefox

Result

Malware family:

purplefox

Alert

Create hunting rule

Score:

  10/10

Tags:

family:gh0strat family:purplefox rat rootkit trojan

Link:

https://tria.ge/reports/240101-aabhcagdak/

Behaviour

Checks processor information in registry

Suspicious behavior: EnumeratesProcesses

Enumerates connected drives

Detect PurpleFox Rootkit

Gh0st RAT payload

Gh0strat

PurpleFox

UnpacMe INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess MALWARE_Win_FatalRAT Hidden MALWARE_Win_PCRat INDICATOR_TOOL_RTK_HiddenRootKit MALWARE_Win_Zegost potential_termserv_dll_replacement

Unpacked files

SH256 hash:

838e034e27aa37c05bc9df1ec553990ee64afbe6adffa03a6f3decb730a2caca

MD5 hash:

c05674d936917dc6989f44ffdba28a24

SHA1 hash:

6ddbb07cd66f86ed937a1c7938fae4ec6c354950

Detections:

INDICATOR_SUSPICIOUS_EXE_ClearMyTracksByProcess

Alert

Create hunting rule

MALWARE_Win_FatalRAT

Alert

Create hunting rule

Hidden

Alert

Create hunting rule

MALWARE_Win_PCRat

Alert

Create hunting rule

INDICATOR_TOOL_RTK_HiddenRootKit

Alert

Create hunting rule

MALWARE_Win_Zegost

Alert

Create hunting rule

potential_termserv_dll_replacement

Alert

Create hunting rule

Link:

https://www.unpac.me/results/220e1d39-64bb-45f4-a10b-ba8e7a0030e1/

Parent samples :

83395fe7f111fad16d1a69edf49dd0a52b34009930f5746631b1f240dc54e4f3
eaa840e393c8f8a3bdcd865ea6eff59f586e14bd9c3518d88098062056964281
40e261e7bffce05b06dc3d6feaa430d310ec8bde473e1136255965b8aa28f925
5e4f250d0488ca67cd13e2e8c50eba3f8b6da8b99095a561378eab18bcd4a4a0
68abafd00ce80bf87b40ac64359794d75bedc8799e787511e6bd20f6a88295d2

SH256 hash:

eaa840e393c8f8a3bdcd865ea6eff59f586e14bd9c3518d88098062056964281

MD5 hash:

7aad7c8ad75a96d9dd0f32ae5b51aca7

SHA1 hash:

834d5d05d7361412dada35950e98fbedef66d7e3

Link:

https://www.unpac.me/results/220e1d39-64bb-45f4-a10b-ba8e7a0030e1/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/eaa840e393c8f8a3bdcd865ea6eff59f586e14bd9c3518d88098062056964281

Comments

---

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

zbet commented on 2023-12-31 23:59:21 UTC

url : hxxp://154.91.227.10/mm.txt