Extracted

• • Target
    GHOST RAT 2026(2)/GHOST RAT 2026‌.exe
  • Size 1.5MB
  • SHA256 2f33dff475caaba4591d864e156ba9e12ac4afb174bc24051901acfbca424fcf
  • MD5 f6e14c706e1e10602872fd34be05581e
  • SHA1 b1d0c0a23eba3bb367da41d282b0aabc84f12f4c
  • SHA512 f4ad33eae5c760c7e1a971526c879ca360749c05043866449123d4b7152d2a7f38d607730a4cc3a6867c20d016ea8d16c1509788d8c43985e2681fb1ef8f7444
  • SSDEEP 24576:qRrEKqm519R0MQtZVdeCxf4/lmUc+Fk8Qru/GdHRkhVSxczxwWJtw:qRIm5/JQreCxoluIknru6HoVIczZ
  • TLSH
    T1007533A29F7EF109FDE7A1BA7077A407C679D94EDE41530712B281328AD3D4C687C426
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionasyncratquasarstormkittyvenomratpersistenceratrootkitspywarestealertrojancredential_access

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Family: Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Family: StormKitty

    StormKitty is an open source info stealer written in C#.

    stealerstormkitty

  • Family: VenomRAT

    VenomRAT is a modified version of QuasarRAT with some added features, such as rootkit and stealer capabilites.

    ratrootkitstealervenomrat

  • Quasar payload

  • StormKitty payload

  • Custom signature

    VenomRAT

    Detects VenomRAT.

    rat

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Uses browser remote debugging

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer

  • .NET Reactor proctector

    Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Indicator Removal: File Deletion

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    GHOST RAT 2026(2)/Windows_Defender_Disable_Guide_Multilanguage.pdf
  • Size 2.7MB
  • SHA256 6901e15368154a015d146c90405070365e4a57db57334b8756d496581a14a32f
  • MD5 ecc348b84ec8ad26a20d49f8a4a4ff84
  • SHA1 1e143c402e6eec740032ef3a633b2cc28f4fb0d7
  • SHA512 ac458b67151d06a7c6c596e715fae562568a8c55cdd74fc99cc92fd73107035ff0c95b1fa9aec659fa0fee94f9aed50749ea71811c6c59135ac85d608f6c7397
  • SSDEEP 49152:hcpkpPv5WV3riFs1tetlWBGdAJ/1usflDfhvutwhIgasPRMgKjZLUxo9Fdfz8/9i:hI+JWV3JreXWBGG/ic8sJzWpd
  • TLSH
    T1EFD5AB73603619079477CB68CCC5AFFE3B61F4C6B95683E5E02ECE04719AA11DC1DAA8
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  adwarediscoveryspyware
  behavioral3behavioral4
• • Target
    GHOST RAT 2026(2)/_build/Debug/ghost.dll
  • Size 456KB
  • SHA256 68c327aa6eedc252114da8d5644b396b28b272013f1c67d82c574cd196bc75ea
  • MD5 c0f9a61c8706b7e9ae467619ba195e85
  • SHA1 8b88219ec4f546250f62f298b23f959635c778ae
  • SHA512 4990c5b199af1feb3929923ab527f8c1ef81d780b737322fa8d1a5a80068cb9b9a2cf903de47e13123eae6cff1fbb8ff7f19174c12c40fb4babaa046aa5db39b
  • SSDEEP 12288:0tS02t6QdU2luj6tXY4XFp/NTI+EUnHNH0IgqZ56zXAWoGdD1a1o1L5HIrOU8ndB:0InvdUMuj6tXY4XFp/NTI+EUnHNH0Igt
  • TLSH
    T16DA4515602E63D67C4B76BB6F7731398F22A9C05BB81A79A4497A20404F434EF753EC2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral5behavioral6
• • Target
    GHOST RAT 2026(2)/_build/Release/ghost.dll
  • Size 338KB
  • SHA256 b0bc056257f5bee8532b5978c082d9fd173eb07128aea13af83938ca94ebe4dd
  • MD5 3b491b7d2e499a6e99eb4041c519a966
  • SHA1 842627191fe181fca8bc115507baab36f4b91654
  • SHA512 5655ff27161b79dccda10ac55933fbd12788534c6cec1a20a7583c04be4096facf8c1e8e7467d9542690f8f956b442286f9673ca7b83afaa36294171a70855d3
  • SSDEEP 6144:Iej8gAwB+9AhuU6tXqYXForMOQNTI+EUdHWA0ITmz56zXxzoEdq1a1o1G1HIrOU:IC8gACxuU6tXqYXFsQNTI+EUdHWA0ITL
  • TLSH
    T15A741F5142FA3D67D4772BB2F7730398F26ADC05FB8297954597A20804B930EF692EC2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral7behavioral8
• • Target
    GHOST RAT 2026(2)/_resources/ghost.html
  • Size 1KB
  • SHA256 248faa64fa7f5bc5361f7b6e85b9d5cc28b339686a8b12514e954ceabcb2e920
  • MD5 0b38f22528d2bf09a9e1cb4283226583
  • SHA1 57825af884c80cc8f0d4588f1b205b6f206e5948
  • SHA512 d10717fef65e2c6e3afdd419886ef3fe9934503c55c541b81f51b0b48570ea383d6e232b04ce802aa672efab008a3d07fbd05f46caa812f73ab05da5f6b62b6a
  • TLSH
    T17721122EE802C3CA30747C0FCC8C3A44E85048C0823ADAA3A572F7E969FC3C8902032C
  • MD5 SHA1 SHA512 TLSH

  Score

  4^/10

  discovery
  behavioral10behavioral9
• • Target
    GHOST RAT 2026(2)/_resources/wget.exe
  • Size 2.9MB
  • SHA256 aa246768b4ce197c1d0945e233975c23acd08b84170cc6581e17cdfd771c0cb3
  • MD5 78c1d46f19ef98dc760e7c40f14ee242
  • SHA1 8dd503566d4c6b2d4bb9c41af2605b986596a15b
  • SHA512 0e9df5420b2fecef210c83b5fdcb0d7f597e89073e848221788c203b357a182b9b72dcbc3e20a256f14ca37a51bce3cb1a9f935d62bb5adb08183d7dd3f56543
  • SSDEEP 49152:O84bklvgA17OhXwlxg4g/BPWOo4uVxYcVtoYpI7Z/LQTd1lmHy/piSo6xRNMnEwl:O9bklvgA17Iwlxg4g/BPWOo4uVxYcVt+
  • TLSH
    T19FE56B05E98744F6ED572A708547F7FF13349B01C434DEFAE968ED0AFA23A12061E25A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral11behavioral12