General
-
Target
Ghostexp.exe
-
Size
3.5MB
-
Sample
230611-v9he6aab8v
-
MD5
e4363df308bd8b81c687412e2314e872
-
SHA1
4d83035b60bc224724e0c5a5192113ae5cd56b99
-
SHA256
843ca5a3bb763223ea854cd0f748081510cab7c4538cd93d0d1d24f0b5aebdc6
-
SHA512
6f7a11dc6d8462899c8071cfe028810d7f1e1b7d8d7fa03d76eb11d4a921fc51d189074c6a20d2ffbb45f2cc9584f19c0345364e6cfd5ae0215c8ed2133e844e
-
SSDEEP
98304:H9Sr7B6eEtduW/bC+1TzAoEZUI4A0AFKiNkTPAQ:dS/keEtduW/REZU8nF6TPH
Behavioral task
behavioral1
Sample
Ghostexp.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Ghostexp.exe
Resource
win10v2004-20230220-en
Malware Config
Targets
-
-
Target
Ghostexp.exe
-
Size
3.5MB
-
MD5
e4363df308bd8b81c687412e2314e872
-
SHA1
4d83035b60bc224724e0c5a5192113ae5cd56b99
-
SHA256
843ca5a3bb763223ea854cd0f748081510cab7c4538cd93d0d1d24f0b5aebdc6
-
SHA512
6f7a11dc6d8462899c8071cfe028810d7f1e1b7d8d7fa03d76eb11d4a921fc51d189074c6a20d2ffbb45f2cc9584f19c0345364e6cfd5ae0215c8ed2133e844e
-
SSDEEP
98304:H9Sr7B6eEtduW/bC+1TzAoEZUI4A0AFKiNkTPAQ:dS/keEtduW/REZU8nF6TPH
Score6/10-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-