Ghost+Stealer.zip
- SHA256 2389f707ea454c9643631a8936557ea2abb39323d824cbd15759eee10c67cf46
Overview
overview
10Static
static
10Ghost+Stealer.zip
windows7-x64
1Ghost+Stealer.zip
windows10-2004-x64
1Ghost Stea...xe.xml
windows7-x64
3Ghost Stea...xe.xml
windows10-2004-x64
1Ghost Stea...er.pdb
windows7-x64
3Ghost Stea...er.pdb
windows10-2004-x64
3Ghost Stea...st.exe
windows7-x64
1Ghost Stea...st.exe
windows10-2004-x64
6Ghost Stea...st.exe
windows7-x64
10Ghost Stea...st.exe
windows10-2004-x64
10Ghost Stea...ib.dll
windows7-x64
1Ghost Stea...ib.dll
windows10-2004-x64
1Ghost Stea...ub.exe
windows7-x64
3Ghost Stea...ub.exe
windows10-2004-x64
10Ghost Stea...config
windows7-x64
3Ghost Stea...config
windows10-2004-x64
3Behavioral task
behavioral1
Sample
Ghost+Stealer.zip
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Ghost+Stealer.zip
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Ghost Stealer/Ghost.builder.exe.xml
Resource
win7-20240704-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral4
Sample
Ghost Stealer/Ghost.builder.exe.xml
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Ghost Stealer/Ghost.builder.pdb
Resource
win7-20240708-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral6
Sample
Ghost Stealer/Ghost.builder.pdb
Resource
win10v2004-20240802-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
Ghost Stealer/Ghost.exe
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Ghost Stealer/Ghost.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral9
Sample
Ghost Stealer/Ghost.exe
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral10
Sample
Ghost Stealer/Ghost.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral11
Sample
Ghost Stealer/ResourceLib.dll
Resource
win7-20240705-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
Ghost Stealer/ResourceLib.dll
Resource
win10v2004-20240802-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
Ghost Stealer/Stub/stub.exe
Resource
win7-20240704-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral14
Sample
Ghost Stealer/Stub/stub.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral15
Sample
Ghost Stealer/Stub/stub.exe.config
Resource
win7-20240708-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral16
Sample
Ghost Stealer/Stub/stub.exe.config
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target Ghost+Stealer.zip
- Size 996KB
- Sample240903-d9jjsaxele
- SHA256 2389f707ea454c9643631a8936557ea2abb39323d824cbd15759eee10c67cf46
- MD5 0fc43a86618a27f526b1deca8ea10230
- SHA1 778576f05abd13b47e3d6ca2ed376a2fff4d5631
- SHA512 6466ec9960bd656f15dd2573b9d61dc3ccd95ff020a69db609b794dc610e3e8eb4e8fa9fc1333c963bce011af39729ccbc1b0e2db49fce073b0f57d054d86398
- SSDEEP 24576:3ayYJsxkASilelLzUyBapr8IrQxD38AkWSixej5zGUBN:3a4kASilelvar8EAkWSixejRZ
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Detect Umbral payload 1 IoCs
resource yara_rule static1/unpack001/Ghost Stealer/Ghost.payload family_umbral - Umbral family
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/Ghost Stealer/Ghost.exe unpack001/Ghost Stealer/Ghost.payload unpack001/Ghost Stealer/ResourceLib.dll unpack001/Ghost Stealer/Stub/stub.exe
File Explorer
-
Ghost+Stealer.zip.zip 996KB
-
Ghost Stealer/Ghost.builder.exe.config.xml 163B
-
Ghost Stealer/Ghost.builder.pdb113KB
-
Ghost Stealer/Ghost.exe.exe 1.2MB
-
Ghost Stealer/Ghost.payload.exe 230KB
-
Ghost Stealer/ResourceLib.dll.dll 76KB
-
Ghost Stealer/Stub/stub.exe.exe 1.2MB
-
Ghost Stealer/Stub/stub.exe.config759B
Ghost Stealer/Ghost.builder.exe.config
- SHA256 6862b25736259f7bfd344e43eea10a703885be381eee2a745ceb12916b01a158
- MD5 dccd44fb11b8e4ebdfb822e809a54b6f
- SHA1 1889d5ae8c7c70c051cbde104af6e0f31f8c1b63
- SHA512 dadffe41bdadfc3a79cb34369c9a8b37ce4833aee18058b02dcb13d64007f022b80b63ab404572c60278937cf83b06b00712ff9ee302e725b9d5c7fe14bd5f50
- MD5 SHA1 SHA512
Ghost Stealer/Ghost.builder.pdb
- SHA256 58f1ca3f7165b0688db2cbf2ec91c0df5dacb43ee03fcd9ddd2a500d162e6899
- MD5 9923a8c48c0375680cd8f34fb9a6b8d0
- SHA1 d1e8cf4fbfa19bf86e3877a641e8e3f2582d95c6
- SHA512 ac0222ec40f5fc62007314ef5e387a0c60743305b50b43d34c56eaad8fbe9210847206067f7ea0f5eede0be6dd5a0729ce4477fa367557b10b5017c721222c04
- SSDEEP 1536:1QAYHXpGuF9AVm6XDAUpT+tq91M/ihARY+C3QA:uHBF9AdTAU8AhARY
- MD5 SHA1 SHA512 SSDEEP
Ghost Stealer/Ghost.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 5bc1900d65e4daa0d587ecadee83113aff82facb5259ec1a6988ef25dae7df7d
- MD5 b77a263bcb2c18a1b922c642c0cc5ee2
- SHA1 90e423f769d7cff75ba8bd362f07b7789ddb8eed
- SHA512 bf00a292c67d49f6155b057fd3f4666a309f86de60d20948ac5a34ef333658e1afe3e064ffd8c80eccad68181ecbf2b7f896624437e7dfcf37773416a59b0ca6
- SSDEEP 12288:6iOokH48FBakxSixBfraTyInY2tpJg7yICBRIkg8A:6iOAukKSine/pzmwBI5
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1294346
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
ba; L
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
ba; L
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
304B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
cSgKFwJB
Size
512B
Virtual Size
22B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.????
Size
512B
Virtual Size
276B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Y
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc1
Size
23KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ghost Stealer/Ghost.payload
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 23d651ed623affcb1b71457c07c4f887a6ac44b04ceef74850292ab38d1b3287
- MD5 da7d94f96e8b7f035020b7721e968ec1
- SHA1 a30abe39a9e27e5eb76fb509eb4f9edeb7c36f5e
- SHA512 181bf779331cbe6f456a44963004e84d8850e1a61350bae66c4e5001d185740c5fbab44b536e3e055871029db23409db376778488ea1d0098ac89786387bd6e2
- SSDEEP 3072:WP+1vofuiMY9QF1c7ROhOtXrLmBGIgXyPyTuuu5bO4ickEw8eFJMwT0kE/0RQ:lQ9Q4XYuTuuufS8eFJLhE
- MD5 SHA1 SHA512 SSDEEP
-
Detect Umbral payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
240162
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
E:\C# Projects\Umbral Stealer\Umbral.payload\obj\Release\Umbral.payload.pdb
mscoree
_CorExeMain
Name
.text
Size
227KB
Virtual Size
226KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ghost Stealer/ResourceLib.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 7da3f0e77c4dddc82df7c16c8c781fade599b7c91e3d32eefbce215b8f06b12a
- MD5 944ce5123c94c66a50376e7b37e3a6a6
- SHA1 a1936ac79c987a5ba47ca3d023f740401f73529b
- SHA512 4c034ff51cc01567f3cb0796575528ca44623b864eb606266bcf955a9259ed26b20bec0086d79038158d3a5af2ada0a90f59d7c6aae9e545294fe77825dbe08b
- SSDEEP 1536:CSSYikTF0Z+sFGu11tIcyI1MtI9eDG3fL7:CJYD0Z9FGu11teI1r9ea3
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
83158
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\projects\resourcelib\Source\ResourceLib\obj\Release\net45\Vestris.ResourceLib.pdb
mscoree
_CorDllMain
Name
.text
Size
73KB
Virtual Size
73KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ghost Stealer/Stub/stub.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 e1f56d8ad0dfea880281406424191daebbc1f77eb30ca25d997f26fd6cc71070
- MD5 a807001286f0d4f3336e9a45e6184558
- SHA1 4253769235f75848632e559a2e15d0ef9708a479
- SHA512 693221c1809c9d338e0ac270a0cf6aa6f277026b58056360180415b96a1a5f47104376e4fe37e0f6a2e929c5a9e7547afe0fa0d5b6ee8d12a76012affb718d42
- SSDEEP 12288:ZiOokH48FBakxSixBfraTyInY2tpJg7yICBRIkx:ZiOAukKSine/pzmwBp
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
1294346
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
mscoree
_CorExeMain
Name
ba; L
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
ba; L
Size
31KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.text
Size
1.1MB
Virtual Size
1.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
cSgKFwJB
Size
512B
Virtual Size
22B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.????
Size
512B
Virtual Size
276B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Y
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Ghost Stealer/Stub/stub.exe.config
- SHA256 67818858dae8a4d85a158d68ca50bfef345a730dbf12461cfb700f30edee460c
- MD5 a40b70b19e717b2628d2662b61e69f99
- SHA1 c3d59349659cd82fb6b8c093a3df72846541573a
- SHA512 2dfca6af0d7daeafa4803fbf971843e70678eb2ecc73f8559d39a617721c3a9362eba9fd4d158a1227a50d96b6711a9bd9f694eb10532e7caa9694aefa81b794
- MD5 SHA1 SHA512