Overview
overview
10Static
static
3Ghosty Per...FN.exe
windows7-x64
10Ghosty Per...FN.exe
windows10-2004-x64
10Ghosty Per....1.exe
windows7-x64
1Ghosty Per....1.exe
windows10-2004-x64
1Ghosty Per....1.exe
windows7-x64
1Ghosty Per....1.exe
windows10-2004-x64
1Ghosty Per...ry.dll
windows7-x64
5Ghosty Per...ry.dll
windows10-2004-x64
5Ghosty Per...64.dll
windows7-x64
1Ghosty Per...64.dll
windows10-2004-x64
1Ghosty Per...on.dll
windows7-x64
1Ghosty Per...on.dll
windows10-2004-x64
1Ghosty Per...ec.dll
windows7-x64
1Ghosty Per...ec.dll
windows10-2004-x64
1Ghosty Per...z2.dll
windows7-x64
1Ghosty Per...z2.dll
windows10-2004-x64
1Ghosty Per...pe.dll
windows7-x64
1Ghosty Per...pe.dll
windows10-2004-x64
1Ghosty Per...16.dll
windows7-x64
1Ghosty Per...16.dll
windows10-2004-x64
1Ghosty Per...rts.sh
windows7-x64
3Ghosty Per...rts.sh
windows10-2004-x64
3generate-certs.sh
windows7-x64
3generate-certs.sh
windows10-2004-x64
31337/conve...rts.sh
windows7-x64
31337/conve...rts.sh
windows10-2004-x64
3Ghosty Per...or.exe
windows7-x64
1Ghosty Per...or.exe
windows10-2004-x64
1Ghosty Per...64.dll
windows7-x64
1Ghosty Per...64.dll
windows10-2004-x64
1Ghosty Per...64.dll
windows7-x64
1Ghosty Per...64.dll
windows10-2004-x64
1Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27-12-2024 09:45
Static task
static1
Behavioral task
behavioral1
Sample
Ghosty Permanent Spoofer/GHOSTYFN.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral2
Sample
Ghosty Permanent Spoofer/GHOSTYFN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Ghosty Permanent Spoofer/KA-LicenseKey_x86_x64_v1.1.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral4
Sample
Ghosty Permanent Spoofer/KA-LicenseKey_x86_x64_v1.1.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Ghosty Permanent Spoofer/KA-MemIntegrity_x86_x64_v1.1.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral6
Sample
Ghosty Permanent Spoofer/KA-MemIntegrity_x86_x64_v1.1.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Ghosty Permanent Spoofer/SafeGuard-Library.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
Ghosty Permanent Spoofer/SafeGuard-Library.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Ghosty Permanent Spoofer/VMProtectSDK64.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
Ghosty Permanent Spoofer/VMProtectSDK64.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Ghosty Permanent Spoofer/brotlicommon.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
Ghosty Permanent Spoofer/brotlicommon.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Ghosty Permanent Spoofer/brotlidec.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
Ghosty Permanent Spoofer/brotlidec.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Ghosty Permanent Spoofer/bz2.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral16
Sample
Ghosty Permanent Spoofer/bz2.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Ghosty Permanent Spoofer/freetype.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral18
Sample
Ghosty Permanent Spoofer/freetype.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Ghosty Permanent Spoofer/libpng16.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
Ghosty Permanent Spoofer/libpng16.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Ghosty Permanent Spoofer/server/Certificates/generate-certs.sh
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
Ghosty Permanent Spoofer/server/Certificates/generate-certs.sh
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
generate-certs.sh
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral24
Sample
generate-certs.sh
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
1337/convert/generate-certs.sh
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral26
Sample
1337/convert/generate-certs.sh
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Ghosty Permanent Spoofer/server/x64/Release/Emulator.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral28
Sample
Ghosty Permanent Spoofer/server/x64/Release/Emulator.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Ghosty Permanent Spoofer/server/x64/Release/libcrypto-3-x64.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral30
Sample
Ghosty Permanent Spoofer/server/x64/Release/libcrypto-3-x64.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
Ghosty Permanent Spoofer/server/x64/Release/libssl-3-x64.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral32
Sample
Ghosty Permanent Spoofer/server/x64/Release/libssl-3-x64.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
Ghosty Permanent Spoofer/brotlidec.dll
-
Size
49KB
-
MD5
b388b7f74802614467a17854b4bf75ff
-
SHA1
0ec7a95503e27ee4735e0c4a7051125ece957ab1
-
SHA256
da4996a4d6b9e18c3ebce85b5fbd5666950e69e5d0e31afa2eef550c2671bd93
-
SHA512
7c45a583cacf798b36fc6241397536ecb2eb9a846531fa8906c5c93e0680151ab9cf448bfb5a229c38fac8d4b83cdb044f05b95bada5a047e4acbcbc64c4d0d8
-
SSDEEP
768:5GsldGuGMH5uA7IsAkEw6qDbYpz+piuazQxARbYs30yMYRk:5dXn5h8sFEw6qbYF+A1nXRk
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2840 wrote to memory of 2824 2840 rundll32.exe 30 PID 2840 wrote to memory of 2824 2840 rundll32.exe 30 PID 2840 wrote to memory of 2824 2840 rundll32.exe 30