File name:

Gh0st RAT v1.0.rar

Full analysis: https://app.any.run/tasks/2581a017-1c57-457b-b5f5-fdc9686e9820
Verdict: Malicious activity
Analysis date: July 07, 2021, 13:44:05
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32, flags: FirstVolume
MD5:

EF0A7CC5BF13D3569867A20F56682313

SHA1:

949FEA6951EF022B06B91E52BE9876D9852AD40F

SHA256:

285F1196492FC129D454A28FB59B3FB93AAC7DA90EC3557EE99936C7A43C7151

SSDEEP:

24576:+CB4tisXpW7wtTY7F1/qzt0nHItGrBmNpEuLPfg/nh9Djoo33Sb/G:+CBmJs7F1yuotGC3uht3iq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • GhOst RAT v1.0.exe (PID: 2828)
      • Gh0stRAT.exe (PID: 3652)
      • Gh0st .exe (PID: 4056)

    • Runs injected code in another process

      • Gh0st .exe (PID: 4056)
      • iexplore.exe (PID: 3812)

    • Application was injected by another process

      • Explorer.EXE (PID: 1896)

    • Changes the autorun value in the registry

      • Explorer.EXE (PID: 1896)

    • Drops executable file immediately after starts

      • Explorer.EXE (PID: 1896)

  • SUSPICIOUS

    • Creates files in the user directory

      • Explorer.EXE (PID: 1896)

    • Checks supported languages

      • WinRAR.exe (PID: 1164)
      • Gh0stRAT.exe (PID: 3652)
      • GhOst RAT v1.0.exe (PID: 2828)
      • Gh0st .exe (PID: 4056)
      • Explorer.EXE (PID: 1896)

    • Reads the computer name

      • WinRAR.exe (PID: 1164)
      • Gh0stRAT.exe (PID: 3652)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1164)
      • Gh0stRAT.exe (PID: 3652)
      • Explorer.EXE (PID: 1896)

    • Drops a file with too old compile date

      • WinRAR.exe (PID: 1164)
      • Gh0stRAT.exe (PID: 3652)
      • Explorer.EXE (PID: 1896)

    • Starts Internet Explorer

      • Explorer.EXE (PID: 1896)

    • Reads default file associations for system extensions

      • Gh0stRAT.exe (PID: 3652)

    • Removes files from Windows directory

      • iexplore.exe (PID: 3812)

  • INFO

    • Checks supported languages

      • NOTEPAD.EXE (PID: 2160)
      • notepad.exe (PID: 1844)
      • iexplore.exe (PID: 3812)

    • Manual execution by user

      • NOTEPAD.EXE (PID: 2160)
      • GhOst RAT v1.0.exe (PID: 2828)
      • Gh0st .exe (PID: 4056)
      • iexplore.exe (PID: 3812)
      • notepad.exe (PID: 1844)

    • Reads the computer name

      • iexplore.exe (PID: 3812)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

ArchivedFileName: Gh0st RAT v1.0\Gh0stRAT\Gh0stRAT.exe
PackingMethod: Normal
ModifyDate: 2012:09:03 23:33:09
OperatingSystem: Win32
UncompressedSize: 1843200
CompressedSize: 1131206
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
45
Monitored processes
8
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start inject winrar.exe notepad.exe no specs ghost rat v1.0.exe no specs gh0strat.exe gh0st .exe no specs iexplore.exe no specs notepad.exe no specs explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
1164"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Gh0st RAT v1.0.rar"C:\Program Files\WinRAR\WinRAR.exe
Explorer.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
1844"C:\Windows\system32\notepad.exe" C:\Windows\system32\notepad.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1896C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE
—
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2160"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\Gh0st RAT v1.0\ReadMe.txtC:\Windows\system32\NOTEPAD.EXE—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2828"C:\Users\admin\Desktop\Gh0st RAT v1.0\GhOst RAT v1.0.exe" C:\Users\admin\Desktop\Gh0st RAT v1.0\GhOst RAT v1.0.exe—Explorer.EXE
User:
admin
Company:
Dz_force TEAm
Integrity Level:
MEDIUM
Description:
Gh0stRAT v1.0
Exit code:
0
Version:
1.00
Modules
Images
c:\users\admin\desktop\gh0st rat v1.0\ghost rat v1.0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvbvm60.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
3652"C:\Users\admin\Desktop\Gh0st RAT v1.0\Gh0stRAT\Gh0stRAT.exe"C:\Users\admin\Desktop\Gh0st RAT v1.0\Gh0stRAT\Gh0stRAT.exe
GhOst RAT v1.0.exe
User:
admin
Company:
https://www.facebook.com/HaCkIngIsOurBlOod
Integrity Level:
MEDIUM
Description:
Gh0stRAT v1.0
Exit code:
0
Version:
1, 0, 0, 0
Modules
Images
c:\users\admin\desktop\gh0st rat v1.0\gh0strat\gh0strat.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
3812"C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe—Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
4056"C:\Users\admin\Desktop\Gh0st RAT v1.0\Gh0st .exe" C:\Users\admin\Desktop\Gh0st RAT v1.0\Gh0st .exe—Explorer.EXE
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\desktop\gh0st rat v1.0\gh0st .exe
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
14 483
Read events
13 557
Write events
926
Delete events
0

Modification events

(PID) Process:(1164) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(1164) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(1164) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16C\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1164) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(1164) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Gh0st RAT v1.0.rar
(PID) Process:(1164) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1164) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1164) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1164) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(1896) Explorer.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rar\OpenWithList
Operation:writeName:a
Value:
WinRAR.exe
Executable files
6
Suspicious files
5
Text files
2
Unknown types
8

Dropped files

PID
Process
Filename
Type
1896Explorer.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\290532160612e071.automaticDestinations-msautomaticdestinations-ms
MD5:—
SHA256:—
1896Explorer.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\1b4dd67f29cb1962.automaticDestinations-msautomaticdestinations-ms
MD5:—
SHA256:—
1896Explorer.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\ReadMe.txt.lnklnk
MD5:—
SHA256:—
1164WinRAR.exeC:\Users\admin\Desktop\Gh0st RAT v1.0\OCX\actskin4.ocxexecutable
MD5:—
SHA256:—
1164WinRAR.exeC:\Users\admin\Desktop\Gh0st RAT v1.0\RunMe.regtext
MD5:—
SHA256:—
1896Explorer.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\Gh0st RAT v1.0.rar.lnklnk
MD5:—
SHA256:—
1164WinRAR.exeC:\Users\admin\Desktop\Gh0st RAT v1.0\ReadMe.txttext
MD5:—
SHA256:—
1896Explorer.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\918e0ecb43d17e23.automaticDestinations-msautomaticdestinations-ms
MD5:—
SHA256:—
1896Explorer.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\Gh0st RAT v1.0.lnklnk
MD5:—
SHA256:—
1896Explorer.EXEC:\Users\admin\AppData\Roaming\Gh0st .exeexecutable
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Gh0st RAT v1.0.rar