Overview

overview

10

Static

static

10

37214b3734...75.exe

windows7-x64

1

37214b3734...75.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    15701147767.zip

  • Size

    4.1MB

  • MD5

    40565dffe6fd906713104947a8ef2f12

  • SHA1

    42837fbf889c27a8f8297c7d8959d800bb63f0da

  • SHA256

    4b82bcc964820d3ddbb105e1ef5eb85a2d1902ffa0381c4bffa251069adbc10e

  • SHA512

    11795a07fea412024c551a02a46513ebe6722980e56c5aa914b90ce813388d451c814244aea857d10c6b82324aa4a7ca1ae7ac2969f0dc78c15aff90559ea7bb

  • SSDEEP

    98304:ZQz0GhBK1SUUHQ/C8wNDf+gk/bxiwMNcWeTq7haE5FNjjuCWrPRD:Z0lBKpUwGNi/iwhWz4E5FNjju5RD

Score
10/10
ghostlocker

Malware Config

Extracted

Family

ghostlocker

C2

http://41.216.183.31/incrementLaunch

http://41.216.183.31/addInfection

Signatures

  • Ghostlocker family
    ghostlocker
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 15701147767.zip
    .zip

    Password: infected

  • 37214b37345bfbeeacf7b83ecb4e1ce0044acc2066d14e7ef9a87fd56a3b5975
    .exe windows:6 windows x64 arch:x64

    Password: infected

    4f2f006e2ecf7172ad368f8289dc96c1


    Headers

    Imports

    Sections