MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f8f702d9e583d84e9b94b4eb610e4be7f199409cbb3a548801be1384fbfcaa12. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 9

Intelligence 9 IOCs YARA 5 File information Comments

SHA256 hash:	f8f702d9e583d84e9b94b4eb610e4be7f199409cbb3a548801be1384fbfcaa12
SHA3-384 hash:	e3faf21af8a5da5a0d5439b08e28c718a3927cfe97e9f1b96c9abcbf36c6e40ebf97b60ad3712b73408b8060b528128c
SHA1 hash:	062caf584b8a381cf4af68985f2e642b1bb2a135
MD5 hash:	a7c3ec6015767fb0aea0f127ea359aa6
humanhash:	ceiling-moon-utah-nebraska
File name:	GHOSTT.exe
Download:	download sample
File size:	56'832 bytes
First seen:	2026-10-22 09:37:32 UTC
Last seen:	Never
File type:	dll
MIME type:	application/vnd.microsoft.portable-executable
imphash	dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 62 x CobaltStrike, 44 x JanelaRAT)
ssdeep	768:ntjr6GrIRR1Lqe6a5K5oW0Kaf34qlYAJd7JsEEaJBPPkRQ/a31W6x:tv6kGmeKarKCPFsE7VPkRQYp
TLSH	T1AA43DC9C765075DFC86BC872DAA81C64EA6074BB431BD243906316EDAE0D99BCF190F3
TrID	88.5% (.DLL) Generic .NET DLL/Assembly (236632/4/32) 2.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 2.4% (.EXE) Win64 Executable (generic) (6522/11/2) 1.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 1.6% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
Reporter	chronobserver
Tags:	dll

Intelligence

File Origin

# of uploads :

# of downloads :

178

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

ConfuserEx

Details

Link:

https://research.acce.ciphertechsolutions.com/results/9a1de077-efda-4176-b5f7-2b9e67635ef7/

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/94018/

Detection(s):

SecuriteInfo.com.Variant.Yogi.89374.22897449.UNOFFICIAL

Verdict:

Malicious

Score:

95.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ad9d98c5a22ac805bd97fec

Tags:

packed virus micro

Result

Verdict:

Clean

Maliciousness:

Behaviour

Sending a custom TCP request

Gathering data

Verdict:

Malicious

Labled as:

MSILHeracles.Generic

Link:

https://www.hybrid-analysis.com/sample/f8f702d9e583d84e9b94b4eb610e4be7f199409cbb3a548801be1384fbfcaa12

Verdict:

Malicious

File Type:

executable.pe.32.dll

First seen:

2026-09-29T22:54:00Z UTC

Last seen:

2026-10-19T18:18:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/f8f702d9e583d84e9b94b4eb610e4be7f199409cbb3a548801be1384fbfcaa12/results?tab=lookup

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/d974430d-f7f2-4da3-8f11-3f240f52ebfe

Score:

91%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/f8f702d9e583d84e9b94b4eb610e4be7f199409cbb3a548801be1384fbfcaa12

Verdict:

inconclusive

YARA:

10 match(es)

Tags:

.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.99 Win 32 Exe x86

Link:

https://app.malva.re/file/a7c3ec6015767fb0aea0f127ea359aa6

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f8f702d9e583d84e9b94b4eb610e4be7f199409cbb3a548801be1384fbfcaa12/

Threat name:

Win32.Trojan.Ravartar

Status:

Malicious

First seen:

2026-09-30 11:02:00 UTC

File Type:

PE (.Net Dll)

AV detection:

23 of 36 (63.89%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7d3qfwpfqpme5g4uwtvwcdsl47yzsqe4xm5fjcabxyjyj674vija._file

Result

Malware family:

n/a

Score:

5/10

Tags:

discovery

Link:

https://tria.ge/reports/261022-ll69yadz2r/

Behaviour

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Unpacked files

SH256 hash:

f8f702d9e583d84e9b94b4eb610e4be7f199409cbb3a548801be1384fbfcaa12

MD5 hash:

a7c3ec6015767fb0aea0f127ea359aa6

SHA1 hash:

062caf584b8a381cf4af68985f2e642b1bb2a135

Detections:

INDICATOR_EXE_Packed_ConfuserEx

SUSP_OBF_NET_ConfuserEx_Name_Pattern_Jan24

Link:

https://www.unpac.me/results/31205d64-ddca-4d05-a4a5-cb91e19c6153/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.14

Link:

https://yomi.yoroi.company/submissions/f8f702d9e583d84e9b94b4eb610e4be7f199409cbb3a548801be1384fbfcaa12

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	extracted_at_0x44b Create hunting rule
Author:	cb
Description:	sample - file extracted_at_0x44b.exe
Reference:	Internal Research

Rule name:	INDICATOR_EXE_Packed_ConfuserEx Create hunting rule
Author:	ditekSHen
Description:	Detects executables packed with ConfuserEx Mod

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETDLLMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.