ghostlocker | c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a

Sharing

Copy URL Twitter E-mail

General

Target
c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a
Size 7.7MB
Sample241201-ssramayraj
SHA256 c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a
MD5 c30a14b595fa334084cd32fa60b3c827
SHA1 3cd04b60b329388059cf58ce3ee6996559123cfa
SHA512 7e244b3d45874d4cbecf53c6c404cd5681879a776b4a5710327c88d7888b61bdfafd17d462244b9ae8235955d8df148da72215ea61514c01585e4d0132ece9a8
SSDEEP 98304:YLraiumim2uZeGEWyOdLQvu6zer0NGBJMV1ZAU6tSOsN:2Imim2uZ8pvW6fAJMVd6M/N
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ghostlocker

Malware Config

Extracted

Family

ghostlocker

http://41.216.183.31/addInfection

Signatures

Ghostlocker family
ghostlocker

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a

File Explorer

c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a

.exe 7.7MB

c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a

IMPHASH 4f2f006e2ecf7172ad368f8289dc96c1
SHA256 c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a
MD5 c30a14b595fa334084cd32fa60b3c827
SHA1 3cd04b60b329388059cf58ce3ee6996559123cfa
SHA512 7e244b3d45874d4cbecf53c6c404cd5681879a776b4a5710327c88d7888b61bdfafd17d462244b9ae8235955d8df148da72215ea61514c01585e4d0132ece9a8
SSDEEP 98304:YLraiumim2uZeGEWyOdLQvu6zer0NGBJMV1ZAU6tSOsN:2Imim2uZ8pvW6fAJMVd6M/N
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

426848

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

255KB

Virtual Size

623KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

168B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

297B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

436KB

Virtual Size

436KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/32

Size

92KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/46

Size

512B

Virtual Size

43B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/65

Size

891KB

Virtual Size

890KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/78

Size

566KB

Virtual Size

566KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/90

Size

159KB

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

347KB

Virtual Size

346KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

c9f71fc4f385a4469438ef053e208065431b123e676c17b65d84b6c69ef6748a

kernel32

generic