N�|��]��K2K.r+�(�~`��j� ��<t˪6?j��>7�Vs�Һ֑J� ؋C��4V��A�LU�����R �=�@�=eV_�-����Om}b��0�j�]����F����;z��;*L#��=�J.����m��i��b����n�A�*߷�s�-����@r|G�v���%�ϓ��l��M�M.��o�^=pؑk�#Q��?�N3���|����D�|��^D�Xγ@�Ȋ1ǴB�˯�gʤ,A|�Wc����AB��QN������:ztl�V�Ol`�ӆ�R�sRJW����n� �1�1�/�9�\��x�FݐH�@=n�I��q�ĭ����^��}:��O��r 1��(,r:5>���B����Wz�}?��N�NgJp�$eg���o�λ��r����k���&��n�L&Vg!�o��Q��s'�3$D��6��J�"��&�\dg���Ѕ5D�HA�Q�\�2�$��I=���y�c'�/���g��D�2���5�k���I�:�l\�7)�/������6��'�W��U�Z�iǒ��{�MV��{�JA{4;�.E%Z&zb� Rc�u���V����;���;��cz�9}�c%ܛ`�8��͝���T���/�� =z������ˆ�q�ݻ���$��ٙ.{�&�����:����P|�7� !�NlJ,\�J���HϽނ^�-�[:×d��<��G�}�ȃ+�'�2?i��ae�)��xDF'X�&�p��nZ:��-�k���C%��FCA� ŝGF��Iapމl�Y�s��ɘ�Ֆ��@�E2�D�q,J'~o8�{WȌ�gc���^�¨���� �eY�f�J��9*�[is2��\#��xG��ɥ�ֆY�U��M�{9rB��!��ll9���l���w#���]������|t�����o���b��4\QA�Jي�u<8� S���b��Uq��Ɍ$ߍ��/� ���|�`��|���T+Cg4�| ��!����+�Х���ԧ����cSt�QR��� 2��7\���B�8��,�>� Y�E�߸?�L,�S��-�X�mv��=�A �Y�ռЅ��G�o�'�4�ˀ��Wo�ѳ߲�6���p$��䫅P��1z ݼ&�д|`X��J2�E୧�W��hu�3��T��u�ñE)<-��/��-�\��z�� 7�ٿбrd�b��;��d6����,&i��v���� ��.���D&�"��҃� ��%�u�B8������fJZ���`������[ �(�bgo^J-��"��h�Q�� ���~��@o��,��x�uyl�ͤ,�Qpӥ����pz�3�� qA&UaC��e)�i���KE�� ��}qeh��Ce�8P����*����Դ�k���l:k&ya��������8������P�ᨏ����c����~�c[�+;3��.# �Uy�(��8~P�;q��Ⱦ`!��}Y�ع���'M(�-����n���f�;�MNm��>�͠��!Q7�4I5���u����ܯ��riŚ'�ic�GQ>�؏�MB�O�![��.��X~���5'Ί���w[6��No��c�.DW��gq��7������؏,~���M�9窹����Q Z��C�_�m��6�{���BM�b?�gՇ|�1�2!ߐR�Qk6��N�/Wa lC��C,жk���!?��"��`�X�Ϳa�IcF���^�#k�M7�p��~�`9z�Ѷ�a��.���30m�����G�=�%��� ~�]Q�4^��vUH��"XԕC���{��>5&z�5;������_f@���܀�_��BgmVU��o�w�(�1�f/�ݧ~H�WY��q��<��ܶ�].��mJ�}7����&T�=��/��b�N橡�SQ&����w�A�)����}Oh����\g5D '�X���Y}�Qz��K��@o\-�x<�6��T�; �d{�"0�_y��B�uxΨH�$�MA�(" �~pǏx蹷e����M���Up}��q�.Ta��S+��-<��dh��&ѓ�Q��/4k+����\=����ɗ�bȊ�x3�?� �����?�8�N�X�����8B�A�3R�O�j���2̂r iR�O��ow"0�K�ϰ����� n^o�`Պg�~��`m��3=�Q~�����o�u�.9]�R�GG2���8�<l��E��)|��Ӧm���i�xׯ�_꽅�H�݇���X�>�y�,���k&��Pi3�7�r��.$2HY����|�"�*П�nXLg���Gf ����$���D���Mt���Q̳Hz}]�9k���3��2]1q 2�AA�P:'���PDŽc���z'��rͷȕ�f�q��`0Y&�ԓ8��3Mg�5��� �c�$���JUxrE4K�����i#�5�r�������~����7��A�]�����u&&�#�n�w��E����0Teyr����9�������z��s�f/�A\*��U���� ������=/\�V��`x�L��6�}�{>�������e�*>\�6]��p�����"�����.|��B9���&���{f�i�[E�~i�Q��#V��4'�F��e�6��TC�ꩆz��J��y*��q|���%0�Q�Xq_��]������Vw��l��) �c�<�u[��N��I+p�V �8�")A=�d�~�+�����W3� �f�D��l�$<C �U{u%�6��`�&�l������Qp�+��'Y*���%�݂��9Sv�/k�#0(�u⤘�'�\c��$Q���>�Ǖ���ZS�M��ܭ�2x�Hb��lg����rֆ���Ri%zs�Y+Kc�/u0(� ��=���~�D�3LK�����) ]LPhL�pD��|`�S|�ǔ����Ֆ�l+s�F��X�]DЕAm��������9���~�Z�x9q�걵!��۔1���_�H�t=�k��p���J���� �H:? +K�t~�D�O���S���;���F�x���̫͛/#�.k_����E�Q�(#E�G��8����� Czm�1zq��Q�<��,�/� "�&����5T�
Static task
static1
Behavioral task
behavioral1
Sample
GhostWareGhost.exe
Resource
win10v2004-20240412-en
General
-
Target
GhostWareGhost.exe
-
Size
5.6MB
-
MD5
0da37622f620176e490ccd1779c6c01e
-
SHA1
aa0e90189dcb688c8994cfebdc82739e28c78102
-
SHA256
3fae0df07895c228816dbce315c48bc09dcbe7db636493f281a65b84760f1501
-
SHA512
8aaaddf59ea6521feb1ba14ccfb95cb83e0f88a73f281c46a6f3c7d22ea8a24eaefa9dfb0e063cff02d7147369ce8f1483fdee435596f10c2022c25255389170
-
SSDEEP
98304:SnVKzUzZCMBew3IjDCZMPWSKobohZPFzfCbL431yC8/Ml5CGmEinBE1H3:SwzU9zBe3DKMuR3FzfC/ql/l1j+BE5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource GhostWareGhost.exe
Files
-
GhostWareGhost.exe.exe windows:6 windows x64 arch:x64
51235326a5333254d9a2e7b5ce26509f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
UnmapViewOfFile
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetWindowThreadProcessId
CharUpperBuffW
advapi32
CryptDestroyKey
shell32
ShellExecuteA
msvcp140
?always_noconv@codecvt_base@std@@QEBA_NXZ
wininet
InternetOpenUrlA
normaliz
IdnToAscii
wldap32
ord79
crypt32
CertFreeCertificateChain
ws2_32
WSAGetLastError
rpcrt4
RpcStringFreeA
psapi
GetModuleInformation
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
api-ms-win-crt-stdio-l1-1-0
fseek
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-math-l1-1-0
_dclass
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-string-l1-1-0
strncmp
Exports
Exports
Sections
.text Size: - Virtual size: 459KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 112KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.lol0 Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.lol1 Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.lol2 Size: 5.6MB - Virtual size: 5.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ