Overview
overview
10Static
static
3Ghosty Per...FN.exe
windows7-x64
10Ghosty Per...FN.exe
windows10-2004-x64
10Ghosty Per....1.exe
windows7-x64
1Ghosty Per....1.exe
windows10-2004-x64
1Ghosty Per....1.exe
windows7-x64
1Ghosty Per....1.exe
windows10-2004-x64
1Ghosty Per...ry.dll
windows7-x64
5Ghosty Per...ry.dll
windows10-2004-x64
5Ghosty Per...64.dll
windows7-x64
1Ghosty Per...64.dll
windows10-2004-x64
1Ghosty Per...on.dll
windows7-x64
1Ghosty Per...on.dll
windows10-2004-x64
1Ghosty Per...ec.dll
windows7-x64
1Ghosty Per...ec.dll
windows10-2004-x64
1Ghosty Per...z2.dll
windows7-x64
1Ghosty Per...z2.dll
windows10-2004-x64
1Ghosty Per...pe.dll
windows7-x64
1Ghosty Per...pe.dll
windows10-2004-x64
1Ghosty Per...16.dll
windows7-x64
1Ghosty Per...16.dll
windows10-2004-x64
1Ghosty Per...rts.sh
windows7-x64
3Ghosty Per...rts.sh
windows10-2004-x64
3generate-certs.sh
windows7-x64
3generate-certs.sh
windows10-2004-x64
31337/conve...rts.sh
windows7-x64
31337/conve...rts.sh
windows10-2004-x64
3Ghosty Per...or.exe
windows7-x64
1Ghosty Per...or.exe
windows10-2004-x64
1Ghosty Per...64.dll
windows7-x64
1Ghosty Per...64.dll
windows10-2004-x64
1Ghosty Per...64.dll
windows7-x64
1Ghosty Per...64.dll
windows10-2004-x64
1Analysis
-
max time kernel
13s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
27-12-2024 09:45
Static task
static1
Behavioral task
behavioral1
Sample
Ghosty Permanent Spoofer/GHOSTYFN.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral2
Sample
Ghosty Permanent Spoofer/GHOSTYFN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Ghosty Permanent Spoofer/KA-LicenseKey_x86_x64_v1.1.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral4
Sample
Ghosty Permanent Spoofer/KA-LicenseKey_x86_x64_v1.1.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Ghosty Permanent Spoofer/KA-MemIntegrity_x86_x64_v1.1.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral6
Sample
Ghosty Permanent Spoofer/KA-MemIntegrity_x86_x64_v1.1.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Ghosty Permanent Spoofer/SafeGuard-Library.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
Ghosty Permanent Spoofer/SafeGuard-Library.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Ghosty Permanent Spoofer/VMProtectSDK64.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
Ghosty Permanent Spoofer/VMProtectSDK64.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Ghosty Permanent Spoofer/brotlicommon.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
Ghosty Permanent Spoofer/brotlicommon.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Ghosty Permanent Spoofer/brotlidec.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
Ghosty Permanent Spoofer/brotlidec.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Ghosty Permanent Spoofer/bz2.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral16
Sample
Ghosty Permanent Spoofer/bz2.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Ghosty Permanent Spoofer/freetype.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral18
Sample
Ghosty Permanent Spoofer/freetype.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Ghosty Permanent Spoofer/libpng16.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
Ghosty Permanent Spoofer/libpng16.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Ghosty Permanent Spoofer/server/Certificates/generate-certs.sh
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
Ghosty Permanent Spoofer/server/Certificates/generate-certs.sh
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
generate-certs.sh
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral24
Sample
generate-certs.sh
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
1337/convert/generate-certs.sh
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral26
Sample
1337/convert/generate-certs.sh
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Ghosty Permanent Spoofer/server/x64/Release/Emulator.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral28
Sample
Ghosty Permanent Spoofer/server/x64/Release/Emulator.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Ghosty Permanent Spoofer/server/x64/Release/libcrypto-3-x64.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral30
Sample
Ghosty Permanent Spoofer/server/x64/Release/libcrypto-3-x64.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
Ghosty Permanent Spoofer/server/x64/Release/libssl-3-x64.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral32
Sample
Ghosty Permanent Spoofer/server/x64/Release/libssl-3-x64.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
Ghosty Permanent Spoofer/freetype.dll
-
Size
675KB
-
MD5
5eb3264c300a0a0a45f22305cff49596
-
SHA1
06ef49a2d145dc98dbd5eea42b1de53b7039b5c4
-
SHA256
9aa4d1356beedaad8f8879b49b76d1ff120dec210a1c0135ede8b9337ad0505d
-
SHA512
a2735a950d3505a7c835e78ed245cbdbff3821d5c9c4ac24b933ee143eab9b95d55ab6cff3bba16229f372077d7cfe2aac9785149ab70e742ed177872cde6ba0
-
SSDEEP
12288:C2xWbECcYWsMWfzJ8JmkMJDX1CxZ4YPma2xtKYENdfEWmb9:C2xBfYWsZflQsXgxvPm/FZ
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2496 wrote to memory of 2488 2496 rundll32.exe 30 PID 2496 wrote to memory of 2488 2496 rundll32.exe 30 PID 2496 wrote to memory of 2488 2496 rundll32.exe 30