MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eb07395404d346ab8cd56d9c5326798d919cf5d0829a0fbd5299de75b2a9af37. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Gh0stRAT


Vendor detections: 9


Intelligence 9 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eb07395404d346ab8cd56d9c5326798d919cf5d0829a0fbd5299de75b2a9af37
SHA3-384 hash: f013ff1ddd80580be434121309e9790fc85f9f64792d1a18ddfaca01c87e2e35d2d2217138520418dd73fd77e00d6447
SHA1 hash: f50b3dc88de68e64294696203986ed31b525e579
MD5 hash: bffa4be5770c93d6c26f77ea43d0635a
humanhash: robin-cold-mango-twenty
File name:MPC-HC.2.5.6.x64.exe
Download: download sample
Signature Gh0stRAT
Create hunting rule
File size:22'984'219 bytes
First seen:2025-12-23 07:08:52 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash efd455830ba918de67076b7c65d86586 (60 x Gh0stRAT, 19 x ValleyRAT, 6 x OffLoader)
ssdeep 393216:ThG+++1eM+xIa9VAD0/MzXKUcXPWl19aLLYRBPfNAcEU9vj7ER07s:wcc9o0/M5lHsLe6G7hs
TLSH T137373323B3C7653FF16E4A3A0A77D2260937B61165124C66DBE818ACCF261D16D3FB42
TrID 62.3% (.EXE) Inno Setup installer (107240/4/30)
24.1% (.EXE) Win32 EXE PECompact compressed (generic) (41569/9/9)
6.1% (.EXE) Win64 Executable (generic) (10522/11/4)
2.6% (.EXE) Win32 Executable (generic) (4504/4/1)
1.2% (.EXE) Win16/32 Executable Delphi generic (2072/23)
Magika pebin
Reporter hyadrogen
Tags:exe Gh0stRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
110
Origin country :
NP NP
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/56d431d6-cd19-401a-aaa8-851879359617/
Malware family:
n/a
ID:
1
File name:
_eb07395404d346ab8cd56d9c5326798d919cf5d0829a0fbd5299de75b2a9af37.exe
Verdict:
No threats detected
Analysis date:
2025-12-23 07:10:09 UTC
Tags:
delphi inno installer
Link:
https://app.any.run/tasks/72ee2a69-74a0-4421-baaf-e03d1153e4ce

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/45806/
Verdict:
Malicious
Score:
94.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=694a4028a6c88bb4cc23dd57
Tags:
ransomware virus blic
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
adaptive-context alien anti-debug crypto embarcadero_delphi explorer fingerprint inno installer installer installer-heuristic keylogger lolbin masquerade overlay packed packed zero
Link:
https://www.filescan.io/uploads/694a401be8abb702f805e30f/reports/e6737c52-36b4-4175-a3f1-f94c9fca02bb/overview
Verdict:
Malicious
Labled as:
Trojan.Alien.aiuu
Link:
https://www.hybrid-analysis.com/sample/eb07395404d346ab8cd56d9c5326798d919cf5d0829a0fbd5299de75b2a9af37
Verdict:
Clean
File Type:
PE
First seen:
2025-12-04T15:15:00Z UTC
Last seen:
2025-12-25T04:48:00Z UTC
Hits:
~1000
Link:
https://opentip.kaspersky.com/eb07395404d346ab8cd56d9c5326798d919cf5d0829a0fbd5299de75b2a9af37/results?tab=lookup
Score:
73%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/eb07395404d346ab8cd56d9c5326798d919cf5d0829a0fbd5299de75b2a9af37
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/bffa4be5770c93d6c26f77ea43d0635a
Gathering data
Verdict:
Clean
Link:
https://tip.neiki.dev/file/eb07395404d346ab8cd56d9c5326798d919cf5d0829a0fbd5299de75b2a9af37
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5mdtsvae2ndkxdgvnwofgjtzrwizz5oqqkna7pksthphlmvjv43q._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
discovery installer
Link:
https://tria.ge/reports/251223-hyxz9awqd1/
Behaviour
Suspicious use of WriteProcessMemory
Inno Setup is an open-source installation builder for Windows applications.
System Location Discovery: System Language Discovery
Executes dropped EXE
Verdict:
Suspicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/78989d01-74ea-492a-a737-9b4a0511921d
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/eb07395404d346ab8cd56d9c5326798d919cf5d0829a0fbd5299de75b2a9af37

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Borland
Create hunting rule
Author:malware-lu
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:shellcode
Create hunting rule
Author:nex
Description:Matched shellcode byte patterns

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/45806/

Comments