bc494dd6a1018d61b8ef7424428b6e43d250a946d1fc7b0c725bf67ba9ad2170

Sharing

Copy URL

Twitter E-mail

General

Target

Ghost-Me-Setup-1.1.8.exe
Size

167.6MB
Sample

240420-egycxafg66
MD5

3ee368d3f9270be6a57569648414358c
SHA1

4e3f118aa9d363195a7e3cb1ffeb1a6f7239d4a7
SHA256

bc494dd6a1018d61b8ef7424428b6e43d250a946d1fc7b0c725bf67ba9ad2170
SHA512

306d362bbf35ced0dfd792d468f27002ea38e2fcaa14a4afc75e177ef802735ef502665f936060139abe60ee1b547f5707400778fbc442d3ee8b3b28347a0f0e
SSDEEP

3145728:IaBAh7jyHn6hEMC8Szlz2PlLEWTjuKC9mgAm3GuEmEQNf+iOk0G92MaPQ:9ApyHipSzlsFhPudmgAm2ugdk0OSQ

Score

7^/10

pyinstaller

Malware Config

Targets

- Target
  
  Ghost-Me-Setup-1.1.8.exe
- Size
  
  167.6MB
- MD5
  
  3ee368d3f9270be6a57569648414358c
- SHA1
  
  4e3f118aa9d363195a7e3cb1ffeb1a6f7239d4a7
- SHA256
  
  bc494dd6a1018d61b8ef7424428b6e43d250a946d1fc7b0c725bf67ba9ad2170
- SHA512
  
  306d362bbf35ced0dfd792d468f27002ea38e2fcaa14a4afc75e177ef802735ef502665f936060139abe60ee1b547f5707400778fbc442d3ee8b3b28347a0f0e
- SSDEEP
  
  3145728:IaBAh7jyHn6hEMC8Szlz2PlLEWTjuKC9mgAm3GuEmEQNf+iOk0G92MaPQ:9ApyHipSzlsFhPudmgAm2ugdk0OSQ
Score

7^/10

pyinstaller
- Loads dropped DLL
behavioral1
- Target
  
  $PLUGINSDIR/SpiderBanner.dll
- Size
  
  9KB
- MD5
  
  17309e33b596ba3a5693b4d3e85cf8d7
- SHA1
  
  7d361836cf53df42021c7f2b148aec9458818c01
- SHA256
  
  996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93
- SHA512
  
  1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298
- SSDEEP
  
  192:5lkE3uqRI1y7/xcfK4PRef6gQzJyY1rpKlVrw:5lkMBI1y7UKcef6XzJrpKY
Score

1^/10
behavioral2
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10
behavioral3
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10
behavioral4
- Target
  
  $PLUGINSDIR/WinShell.dll
- Size
  
  3KB
- MD5
  
  1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1
  
  0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA256
  
  9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- SHA512
  
  7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
Score

3^/10
behavioral5
- Target
  
  Ghost Me.exe
- Size
  
  168.7MB
- MD5
  
  0ada8980f72c51b35dcfa7e17f3c14b9
- SHA1
  
  484449b9be3fd84b92a91f2409dedbb14bbb5f0b
- SHA256
  
  f0217816341e6c68fca56df864d6758233d255b0a29c7b9198f33e64ed67c2bc
- SHA512
  
  68052433b7e2374a6705dcc6a9adb02672065e7b30c1e35edcc04510c99fb5f7fc1e26cdfbd13820b6d37510fc0e91da341a6a586e4e245d045e81a7c3886e84
- SSDEEP
  
  1572864:ZI/Lersitaya/Z2fU8sFcIM4L0l22Hb472TGB2+2T1PD7d00j+ohdOq6g5AgO8x5:AMY/KnD45KKb8xG
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Drops file in System32 directory
behavioral6
- Target
  
  LICENSES.chromium.html
- Size
  
  8.7MB
- MD5
  
  1ca87d8ee3ce9e9682547c4d9c9cb581
- SHA1
  
  d25b5b82c0b225719cc4ee318f776169b7f9af7a
- SHA256
  
  000ae5775ffa701d57afe7ac3831b76799e8250a2d0c328d1785cba935aab38d
- SHA512
  
  ec07b958b4122f0776a6bded741df43f87ba0503b6a3b9cc9cbe6188756dcde740122314e0578175123aaa61381809b382e7e676815c20c3e671a098f0f39810
- SSDEEP
  
  24576:ZQQa6Ne6P5d2WSmwRFXe1vmfpV6k626D6b62vSuSpZ:ZMfTVQ
Score

1^/10
behavioral7
- Target
  
  d3dcompiler_47.dll
- Size
  
  4.7MB
- MD5
  
  2191e768cc2e19009dad20dc999135a3
- SHA1
  
  f49a46ba0e954e657aaed1c9019a53d194272b6a
- SHA256
  
  7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
- SHA512
  
  5adcb00162f284c16ec78016d301fc11559dd0a781ffbeff822db22efbed168b11d7e5586ea82388e9503b0c7d3740cf2a08e243877f5319202491c8a641c970
- SSDEEP
  
  49152:KCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvhiD0N+YEzI4og/RfzHLeHTRhFRNc:xG2QCwmHPnog/pzHAo/A6l
Score

1^/10
behavioral8
- Target
  
  dxcompiler.dll
- Size
  
  20.8MB
- MD5
  
  de686cb5fdd9a5a5849fdd69eada8531
- SHA1
  
  29ce9ace8825b3d82c986e483f6d967fa4aa915a
- SHA256
  
  6d779c8e024f23205e0f1bd152b34b1978b29b81e1aac0ebfbd671f2f80c6904
- SHA512
  
  aa6ff9a22abb652155edd7179d59e451e77ff58b09393fcbded405989c93d3000fc43e128109beb2018e4aa088d2438e85f558b61a7d7391c44481698c606cc6
- SSDEEP
  
  393216:IFMwP3WgSiT84jbMMV+myjPUaM2NEYGM0AD0WMF:IFb2mucMEYGnAIWMF
Score

1^/10
behavioral9
- Target
  
  dxil.dll
- Size
  
  1.4MB
- MD5
  
  cb72bef6ce55aa7c9e3a09bd105dca33
- SHA1
  
  d48336e1c8215ccf71a758f2ff7e5913342ea229
- SHA256
  
  47ffdbd85438891b7963408ea26151ba26ae1b303bbdab3a55f0f11056085893
- SHA512
  
  c89eebcf43196f8660eee19ca41cc60c2a00d93f4b3bf118fe7a0deccb3f831cac0db04b2f0c5590fa8d388eb1877a3706ba0d58c7a4e38507c6e64cfd6a50a0
- SSDEEP
  
  24576:LCfhbh3v3mtZDiAQeWj26k41ob2nrZ1rqpegQDJqoZtp22GkmgA9u808jQPEdkr1:LCfhbh3v3mtEAQrW41obCraeRhy9ou6r
Score

1^/10
behavioral10
- Target
  
  ffmpeg.dll
- Size
  
  2.7MB
- MD5
  
  ebc33ac8fed56425d44eb3505170f331
- SHA1
  
  3f1e3cff6bd025374ca944903e149bd4b3f88fd5
- SHA256
  
  a510ea0deb0c625675d16a07bb7a0542bdd01b42e69ddfb894051bcd9ef23417
- SHA512
  
  4ae16f840c31cbff06c80b5370456de98fdbddd05c49ea82f9299a6ab4ef5964a283d4fb119a424783d836a5488440e5f2baf876c755a4f19eb40861a70775d8
- SSDEEP
  
  49152:TPDtyvMYqXiOaeQ3NZ+GEMDbG7m8x7n6mfu/oBLpweNsgMzqvUdn7xN:jSOONYbQG7m8bdazldn7r
Score

1^/10
behavioral11
- Target
  
  libEGL.dll
- Size
  
  467KB
- MD5
  
  17662d1e0a2253ec36137808e23eeceb
- SHA1
  
  51aff14e5a9511dd34168c7b66f8e1779e65bd60
- SHA256
  
  c974d5161beec3eceefafd253a77e909efe1a2906664a4021a15b0dd7d3fc06c
- SHA512
  
  7b02d36d17f35c8b48c168bb3b866a17956e1a0c16492da5742951fdefda4f8e48a155b9368cb23eadb99dc6f51e13a92525a5a82715d5501aefd21e89413307
- SSDEEP
  
  6144:juF2Dw0NiKxN6YTfDVTCanVJhPadWQo+mehJp/Ej4:60iKbbTfDVJ2dWQo+menp/EU
Score

1^/10
behavioral12
- Target
  
  libGLESv2.dll
- Size
  
  7.4MB
- MD5
  
  6a3717ed30f505678523ddbb4ff53806
- SHA1
  
  1cc6cbc508cd0b56c6b29d63a751a37b4ccec625
- SHA256
  
  fb5a87e029dbb29410badb783d2935f812e95192ff352ba1d3acce3f87757f1a
- SHA512
  
  64b755ddfb608c56aaa346f125b8947acb9e4d085817814358f3af1b93c909943b34bb180852cac5f9048270ca7a9b8e10362fb446d5412447ccdcc7a31088ca
- SSDEEP
  
  98304:0oM1bKXyhXV3XI9f1OW7BheoI1Ty6sDCpsXm3T:0b1TlXIH77iTHWCT
Score

1^/10
behavioral13
- Target
  
  resources/app.asar.unpacked/node_modules/@esbuild/win32-x64/esbuild.exe
- Size
  
  9.0MB
- MD5
  
  921bb4a2f47045eda40cc051edda1bb2
- SHA1
  
  899278f9671bf0ba22e3aad10de216ed9acd4426
- SHA256
  
  9a2b48a26c2934f74d3e48c2897d329094efa5156bc9ed0c8ac65458d8aed414
- SHA512
  
  e180f303fd1b7c52b8439e9d34f71a8e4e3da2ca7f0e0b34b3d4244b9931227646fadafcf2f912cb46c8105eeb7f91b7be5ed02699ce701b95ba9a1536dc5102
- SSDEEP
  
  98304:jqMvm5Q6FB7RJ4lwRHo2E+LZPtD8EZuwq4aKp:jqN/RJ4lkJEj4aK
Score

1^/10
behavioral14
- Target
  
  resources/app.asar.unpacked/node_modules/esbuild-windows-64/bin/esbuild
- Size
  
  758B
- MD5
  
  4644749894d7d4d207855fea461cef2d
- SHA1
  
  844ff61adf294e94159eeee0e12a12bed147edf2
- SHA256
  
  5b50e4c018266861f336b0a7e20470eff66c970458963fcae56696f0d0e103d4
- SHA512
  
  28eca0216084d830306a0788fd59efd5171311c3781b2c2206b86af8f317f914ff3854ba8fee1b421be14dd4e9de5afb804c4417a33f1215e9226c95d8bcd42a
Score

1^/10
behavioral15
- Target
  
  resources/app.asar.unpacked/node_modules/esbuild-windows-64/esbuild.exe
- Size
  
  8.1MB
- MD5
  
  10c987ba1ad8984c0da18e1314ab4939
- SHA1
  
  859a67dfcde0693207dd8b04b3ddee85c02f1ccf
- SHA256
  
  0735a0ae6ea7c5a1523c2291775d30154e5903cbf0b5d0c1eeefb03a551ba7e9
- SHA512
  
  6a9b7a852d73a4d5de0e7028faeaa6ae973024d7da936df86cdacdc3d81077095b64b54b4aa6805309ee3107fc81f9ea2ae215330ffd31a7a39f8d989444decc
- SSDEEP
  
  49152:u4X42klfsj1rb/ThvO90d7HjmAFd4A64nsfJiN0slqzH73XOJI3dTG5bwsUaQYVN:E8PNF+bnVxOsBhE4U6xQ3
Score

1^/10
behavioral16
- Target
  
  resources/elevate.exe
- Size
  
  105KB
- MD5
  
  792b92c8ad13c46f27c7ced0810694df
- SHA1
  
  d8d449b92de20a57df722df46435ba4553ecc802
- SHA256
  
  9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
- SHA512
  
  6c247254dc18ed81213a978cce2e321d6692848c64307097d2c43432a42f4f4f6d3cf22fb92610dfa8b7b16a5f1d94e9017cf64f88f2d08e79c0fe71a9121e40
- SSDEEP
  
  3072:1bLnrwQoRDtdMMgSXiFJWcIgUVCfRjV/GrWl:1PrwRhte1XsE1l
Score

1^/10
behavioral17
- Target
  
  resources/lib/GhostMeHelper.exe
- Size
  
  30.5MB
- MD5
  
  459f6ad6b24d89301d9edd380ce9ae6c
- SHA1
  
  2c8aa9eb410f1fc61547c7791b79f95e12e2cfcf
- SHA256
  
  f4cc471802b37c4f34347899659770abe253fe8bd0de3a1422a0fd297db94764
- SHA512
  
  c0befb8993d2de3b3f5c35704049f6700c78e4b98e7da5089051d1d5dc56b9e9feae2455f45b65d5fbd179cfc10259bac523fa1273939e10c19df14102acdc7f
- SSDEEP
  
  786432:4i4dBtAKEAw3xhW+e5vIHoztZ036eT+Rc0OQUJp2bvekga:ytA/Aw3xhW+e+s0uvZ+2bj
Score

7^/10
- Loads dropped DLL
behavioral18
- Target
  
  vk_swiftshader.dll
- Size
  
  5.0MB
- MD5
  
  ab800e593df67da031c0242aabb2e840
- SHA1
  
  651a0fe0271d2053c8dcfd6937871a2acd224d00
- SHA256
  
  ddd73aac8cd968bb9130b475babd5a061cb12efd3b6617abaed0ca12bd5d072c
- SHA512
  
  a108e93a78ab12e06c777cfd29a68258ab62ffb436438bd7d48520db9f1983efb360142493f5379f3218ab3609de5fcefcb9e640d0dc42e31b833bbbf9fa2f7e
- SSDEEP
  
  49152:QO6ftECL3Zdon2+a/EgBqB1y91lxfAV7xWV9MzaNZ8m8Lg1d7RXmVEZvMUn0Hjyg:QLftMUSogaEm5hZdIOlEbRaB3YII
Score

1^/10
behavioral19
- Target
  
  vulkan-1.dll
- Size
  
  925KB
- MD5
  
  a21a939a1df8b61a7c3073768ae9a57a
- SHA1
  
  1c4054937c3253722b2ef02b3a6ef6adfa85136e
- SHA256
  
  89345e6516ae647ce5d55a12a38b9ea99e7f480af2f5072410cda7a2b899abcd
- SHA512
  
  3ddf24725630872eb7f6df0fdb957c561a5a07fd6dff521a65ddc1abf84ee79ec8ac70257de208a6df1f3486ba3b16facd605d0b01038df46a6e5bd0290743d0
- SSDEEP
  
  24576:ty+lCO+5ia/1DW6pb9MLtX6Z5WdDYsH26g3P0zAk7o3/:tymVqXpbId6Z5WdDYsH26g3P0zAk7ov
Score

1^/10
behavioral20
- Target
  
  $PLUGINSDIR/nsExec.dll
- Size
  
  6KB
- MD5
  
  ec0504e6b8a11d5aad43b296beeb84b2
- SHA1
  
  91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA256
  
  5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- SHA512
  
  3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP
  
  96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
Score

3^/10
behavioral21
- Target
  
  $PLUGINSDIR/nsis7z.dll
- Size
  
  424KB
- MD5
  
  80e44ce4895304c6a3a831310fbf8cd0
- SHA1
  
  36bd49ae21c460be5753a904b4501f1abca53508
- SHA256
  
  b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
- SHA512
  
  c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df
- SSDEEP
  
  6144:aUWQQ5O3fz0NG3ucDaEUTWfk+ZA0NrCL/k+uyoyBOX1okfW7w+Pfzqibckl:an5QEG39fPAkrE4yrBOXDfaNbck
Score

3^/10
behavioral22
- Target
  
  $R0/Uninstall Ghost Me.exe
- Size
  
  292KB
- MD5
  
  c8699041f0917090ae345350ae4bda30
- SHA1
  
  9a3cfd49282537e9578146558e879c33db18b4be
- SHA256
  
  0d8f6976898887d0a5ad9c6112a6978222deed9c6f9516181d550bbd32038bd2
- SHA512
  
  0f13d2b7af143de4214628f9d50c33902db4723bc78f5417b9b7e0ed4d0eeb8d7fea71edaf9021361fbd08bb2f070f7a97a98656dc0725ebaad80571293081b6
- SSDEEP
  
  3072:Pn77v00hEoDEtau8u2oUChMHdrDxWdNWXzyFkclCbqdkwyaH2tvhOEA1RJCir86f:P740IUQWDyjCb8krs2t0EyL+yaU
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral23
- Target
  
  $PLUGINSDIR/StdUtils.dll
- Size
  
  100KB
- MD5
  
  c6a6e03f77c313b267498515488c5740
- SHA1
  
  3d49fc2784b9450962ed6b82b46e9c3c957d7c15
- SHA256
  
  b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
- SHA512
  
  9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803
- SSDEEP
  
  3072:WNuZmJ9TDP3ahD2TF7Rq9cJNPhF9vyHf:WNuZ81zaAFHhF9v
Score

3^/10
behavioral24
- Target
  
  $PLUGINSDIR/System.dll
- Size
  
  12KB
- MD5
  
  0d7ad4f45dc6f5aa87f606d0331c6901
- SHA1
  
  48df0911f0484cbe2a8cdd5362140b63c41ee457
- SHA256
  
  3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
- SHA512
  
  c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9
- SSDEEP
  
  192:1enY0LWelt70elWjvfstJcVtwtYbjnIOg5AaDnbC7ypXhtIj:18PJlt70esj0Mt9vn6ay6
Score

3^/10
behavioral25
- Target
  
  $PLUGINSDIR/WinShell.dll
- Size
  
  3KB
- MD5
  
  1cc7c37b7e0c8cd8bf04b6cc283e1e56
- SHA1
  
  0b9519763be6625bd5abce175dcc59c96d100d4c
- SHA256
  
  9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
- SHA512
  
  7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f
Score

3^/10
behavioral26
- Target
  
  $PLUGINSDIR/nsExec.dll
- Size
  
  6KB
- MD5
  
  ec0504e6b8a11d5aad43b296beeb84b2
- SHA1
  
  91b5ce085130c8c7194d66b2439ec9e1c206497c
- SHA256
  
  5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
- SHA512
  
  3f918f1b47e8a919cbe51eb17dc30acc8cfc18e743a1bae5b787d0db7d26038dc1210be98bf5ba3be8d6ed896dbbd7ac3d13e66454a98b2a38c7e69dad30bb57
- SSDEEP
  
  96:YjHFiKaoggCtJzTlKXb0tbo68qD853Ns7GgmkNq3m+s:JbogRtJzTlNR8qD85uGgmkNr
Score

3^/10
behavioral27

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Process Discovery

T1057

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Checks computer location settings

Loads dropped DLL

Drops file in System32 directory

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Matrix ATT&CK v13

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27