Overview

overview

10

Static

static

10

Ghost+Stealer.zip

windows7-x64

1

Ghost+Stealer.zip

windows10-2004-x64

1

Ghost Stea...xe.xml

windows7-x64

3

Ghost Stea...xe.xml

windows10-2004-x64

1

Ghost Stea...er.pdb

windows7-x64

3

Ghost Stea...er.pdb

windows10-2004-x64

3

Ghost Stea...st.exe

windows7-x64

1

Ghost Stea...st.exe

windows10-2004-x64

6

Ghost Stea...st.exe

windows7-x64

10

Ghost Stea...st.exe

windows10-2004-x64

10

Ghost Stea...ib.dll

windows7-x64

1

Ghost Stea...ib.dll

windows10-2004-x64

1

Ghost Stea...ub.exe

windows7-x64

3

Ghost Stea...ub.exe

windows10-2004-x64

10

Ghost Stea...config

windows7-x64

3

Ghost Stea...config

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target
    Ghost+Stealer.zip
  • Size 996KB
  • Sample240903-d9jjsaxele
  • SHA256 2389f707ea454c9643631a8936557ea2abb39323d824cbd15759eee10c67cf46
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
umbraldiscoveryevasionexecutionpersistenceprivilege_escalationstealertrojan

Malware Config

Targets

    • Target
      Ghost+Stealer.zip
    • Size 996KB
    • SHA256 2389f707ea454c9643631a8936557ea2abb39323d824cbd15759eee10c67cf46
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral1behavioral2
    • Target
      Ghost Stealer/Ghost.builder.exe.config
    • Size 163B
    • SHA256 6862b25736259f7bfd344e43eea10a703885be381eee2a745ceb12916b01a158
    • MD5 SHA1 SHA512
    Score
    3/10
    discovery
    behavioral3behavioral4
    • Target
      Ghost Stealer/Ghost.builder.pdb
    • Size 113KB
    • SHA256 58f1ca3f7165b0688db2cbf2ec91c0df5dacb43ee03fcd9ddd2a500d162e6899
    • MD5 SHA1 SHA512 SSDEEP
    Score
    3/10
    discovery
    behavioral5behavioral6
    • Target
      Ghost Stealer/Ghost.exe
    • Size 1.2MB
    • SHA256 5bc1900d65e4daa0d587ecadee83113aff82facb5259ec1a6988ef25dae7df7d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    6/10
    discovery

    • Drops desktop.ini file(s)

    behavioral7behavioral8
    • Target
      Ghost Stealer/Ghost.payload
    • Size 230KB
    • SHA256 23d651ed623affcb1b71457c07c4f887a6ac44b04ceef74850292ab38d1b3287
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    umbralstealer

    • Detect Umbral payload

    • Umbral

      Umbral stealer is an opensource moduler stealer written in C#.

      stealerumbral
    behavioral10behavioral9
    • Target
      Ghost Stealer/ResourceLib.dll
    • Size 76KB
    • SHA256 7da3f0e77c4dddc82df7c16c8c781fade599b7c91e3d32eefbce215b8f06b12a
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral11behavioral12
    • Target
      Ghost Stealer/Stub/stub.exe
    • Size 1.2MB
    • SHA256 e1f56d8ad0dfea880281406424191daebbc1f77eb30ca25d997f26fd6cc71070
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    discoveryevasionexecutionpersistenceprivilege_escalationtrojan

    • UAC bypass

      evasiontrojan

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Looks for VMWare Tools registry key

      evasion

    • Modifies Windows Firewall

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    behavioral13behavioral14
    • Target
      Ghost Stealer/Stub/stub.exe.config
    • Size 759B
    • SHA256 67818858dae8a4d85a158d68ca50bfef345a730dbf12461cfb700f30edee460c
    • MD5 SHA1 SHA512
    Score
    3/10
    discovery
    behavioral15behavioral16

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

2
T1562

Disable or Modify System Firewall

1
T1562.004

Disable or Modify Tools

1
T1562.001

Modify Registry

2
T1112

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

1
T1120

Query Registry

7
T1012

System Information Discovery

6
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Virtualization/Sandbox Evasion

2
T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks