Overview

overview

10

Static

static

10

8b758ccdfb...e9.exe

windows7-x64

7

8b758ccdfb...e9.exe

windows10-2004-x64

7

a1b468e955...5f.exe

windows7-x64

7

a1b468e955...5f.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target
    Win32.GhostSec.zip
  • Size 7.8MB
  • Sample240422-yzpy2aff71
  • SHA256 90a2d935dcd1ea5a18ffb8194f9a8893ca2f62c9deaccbc8c94855b770387ea2
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
ghostlockerpersistence

Malware Config

Extracted

Family

  • ghostlocker

C2

  • http://94.103.91.246/addInfection

  • http://94.103.91.246/incrementLaunch

Targets

    • Target
      8b758ccdfbfa5ff3a0b67b2063c2397531cf0f7b3d278298da76528f443779e9
    • Size 7.0MB
    • SHA256 8b758ccdfbfa5ff3a0b67b2063c2397531cf0f7b3d278298da76528f443779e9
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10
    persistence

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2
    • Target
      a1b468e9550f9960c5e60f7c52ca3c058de19d42eafa760b9d5282eb24b7c55f
    • Size 7.0MB
    • SHA256 a1b468e9550f9960c5e60f7c52ca3c058de19d42eafa760b9d5282eb24b7c55f
    • MD5 SHA1 SHA512 SSDEEP
    Score
    7/10

    • Drops startup file

    behavioral3behavioral4

MITRE ATT&CK Enterprise v15

Tasks