Ghost_VPN_Free_setup[.]zip

General

Target
Ghost_VPN_Free_setup.zip
Size 933KB
Sample230329-ws6xvsba4s
SHA256 bc99d1bb9a12367979fcd24b696af85816f730c968f4e99df1c506ca99fa709f
MD5 1333e94811c5c6684944da819a330524
SHA1 4c248a332eb42ec2628fd559fbd12d5cf3de49c8
SHA512 4dece5e82fcf0988bd70bf817a4e2e23e390727d2f9881733f16e5c2db7db1dee54282ffa98186fa9c93d42a66a4ce273e9687f90fa74c15f8ecc8195fcf188c
SSDEEP 3072:T6PGPdzLz0VA6AcGkFZSC8K4a6A8d6wXdKVhv4jRdIus:7PhYGbEC9K4aUXtM4ps
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

Ghost_VPN_Free_setup.zip

.zip 933KB
Ghost_VPN_Free_setup.exe

.exe 800.4MB

Ghost_VPN_Free_setup.zip

SHA256 bc99d1bb9a12367979fcd24b696af85816f730c968f4e99df1c506ca99fa709f
MD5 1333e94811c5c6684944da819a330524
SHA1 4c248a332eb42ec2628fd559fbd12d5cf3de49c8
SHA512 4dece5e82fcf0988bd70bf817a4e2e23e390727d2f9881733f16e5c2db7db1dee54282ffa98186fa9c93d42a66a4ce273e9687f90fa74c15f8ecc8195fcf188c
SSDEEP 3072:T6PGPdzLz0VA6AcGkFZSC8K4a6A8d6wXdKVhv4jRdIus:7PhYGbEC9K4aUXtM4ps
MD5 SHA1 SHA512 SSDEEP

Ghost_VPN_Free_setup.exe

IMPHASH 6c3e9c77eb48a74726a14dbd1860421a
SHA256 4556643b2e3a495d9a11e054688f706fcde07aa49d103b9993c7ef98090e003f
MD5 3c00627a91193bc8e85f4301d2d0541e
SHA1 9abe13ec9cd673b1d32f866a4285d334cf3b0363
SHA512 9d9037436c3b1ea6cba947753a34a37aa571e9a9bb9ec930884d502b7502a86d5faa91b1b21e2f8144b8ace96bf4491a6384a60b717ab1f81b8e66c8dd58deb7
SSDEEP 393216:CUwOIEK84WQsykAeYYkAeYUaMImg8C0Qu:
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

39696

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

MultiByteToWideChar FreeConsole GetUserDefaultLangID GetProcessIoCounters SetHandleCount CreateEventW SetSystemTimeAdjustment CreateFileW GetFullPathNameW GetFileInformationByHandle GetLogicalDrives lstrcmpW GetProcessWorkingSetSize CopyFileW GetNativeSystemInfo AssignProcessToJobObject GetNumaHighestNodeNumber LockFileEx ReadConsoleInputW SetFileShortNameW GetModuleHandleA GetProcessTimes GetProcAddress RtlUnwind RaiseException GetCommandLineA GetLastError HeapFree GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapAlloc TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW GetFileType GetStartupInfoA DeleteCriticalSection HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc HeapSize LoadLibraryA InitializeCriticalSectionAndSpinCount LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA

gdi32

SelectObject CreateFontIndirectA

Sharing