Overview
overview
10Static
static
3Ghosty Per...FN.exe
windows7-x64
10Ghosty Per...FN.exe
windows10-2004-x64
10Ghosty Per....1.exe
windows7-x64
1Ghosty Per....1.exe
windows10-2004-x64
1Ghosty Per....1.exe
windows7-x64
1Ghosty Per....1.exe
windows10-2004-x64
1Ghosty Per...ry.dll
windows7-x64
5Ghosty Per...ry.dll
windows10-2004-x64
5Ghosty Per...64.dll
windows7-x64
1Ghosty Per...64.dll
windows10-2004-x64
1Ghosty Per...on.dll
windows7-x64
1Ghosty Per...on.dll
windows10-2004-x64
1Ghosty Per...ec.dll
windows7-x64
1Ghosty Per...ec.dll
windows10-2004-x64
1Ghosty Per...z2.dll
windows7-x64
1Ghosty Per...z2.dll
windows10-2004-x64
1Ghosty Per...pe.dll
windows7-x64
1Ghosty Per...pe.dll
windows10-2004-x64
1Ghosty Per...16.dll
windows7-x64
1Ghosty Per...16.dll
windows10-2004-x64
1Ghosty Per...rts.sh
windows7-x64
3Ghosty Per...rts.sh
windows10-2004-x64
3generate-certs.sh
windows7-x64
3generate-certs.sh
windows10-2004-x64
31337/conve...rts.sh
windows7-x64
31337/conve...rts.sh
windows10-2004-x64
3Ghosty Per...or.exe
windows7-x64
1Ghosty Per...or.exe
windows10-2004-x64
1Ghosty Per...64.dll
windows7-x64
1Ghosty Per...64.dll
windows10-2004-x64
1Ghosty Per...64.dll
windows7-x64
1Ghosty Per...64.dll
windows10-2004-x64
1Analysis
-
max time kernel
13s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
27-12-2024 09:45
Static task
static1
Behavioral task
behavioral1
Sample
Ghosty Permanent Spoofer/GHOSTYFN.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral2
Sample
Ghosty Permanent Spoofer/GHOSTYFN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
Ghosty Permanent Spoofer/KA-LicenseKey_x86_x64_v1.1.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral4
Sample
Ghosty Permanent Spoofer/KA-LicenseKey_x86_x64_v1.1.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
Ghosty Permanent Spoofer/KA-MemIntegrity_x86_x64_v1.1.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral6
Sample
Ghosty Permanent Spoofer/KA-MemIntegrity_x86_x64_v1.1.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
Ghosty Permanent Spoofer/SafeGuard-Library.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
Ghosty Permanent Spoofer/SafeGuard-Library.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Ghosty Permanent Spoofer/VMProtectSDK64.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
Ghosty Permanent Spoofer/VMProtectSDK64.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
Ghosty Permanent Spoofer/brotlicommon.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
Ghosty Permanent Spoofer/brotlicommon.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Ghosty Permanent Spoofer/brotlidec.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral14
Sample
Ghosty Permanent Spoofer/brotlidec.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Ghosty Permanent Spoofer/bz2.dll
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral16
Sample
Ghosty Permanent Spoofer/bz2.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
Ghosty Permanent Spoofer/freetype.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral18
Sample
Ghosty Permanent Spoofer/freetype.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
Ghosty Permanent Spoofer/libpng16.dll
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
Ghosty Permanent Spoofer/libpng16.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Ghosty Permanent Spoofer/server/Certificates/generate-certs.sh
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral22
Sample
Ghosty Permanent Spoofer/server/Certificates/generate-certs.sh
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
generate-certs.sh
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral24
Sample
generate-certs.sh
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
1337/convert/generate-certs.sh
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral26
Sample
1337/convert/generate-certs.sh
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
Ghosty Permanent Spoofer/server/x64/Release/Emulator.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral28
Sample
Ghosty Permanent Spoofer/server/x64/Release/Emulator.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
Ghosty Permanent Spoofer/server/x64/Release/libcrypto-3-x64.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral30
Sample
Ghosty Permanent Spoofer/server/x64/Release/libcrypto-3-x64.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
Ghosty Permanent Spoofer/server/x64/Release/libssl-3-x64.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral32
Sample
Ghosty Permanent Spoofer/server/x64/Release/libssl-3-x64.dll
Resource
win10v2004-20241007-en
windows10-2004-x64
General
-
Target
Ghosty Permanent Spoofer/KA-LicenseKey_x86_x64_v1.1.exe
-
Size
5.3MB
-
MD5
efab4965da18f638ba67ece790fded62
-
SHA1
27687605909f5a885d78268a5fe0112723049581
-
SHA256
93679af51f96edfa02cabea6801aba4484a90449745e2aa78afbd3e13fc1e070
-
SHA512
66e86dca1427245f6ea454287012ece56d44315310b531dd625c2336b26ba4bef2e9f0c8c70649f7e8ec3c3181ed5080c0e72833ea9b43bd742bdeb08b2691dd
-
SSDEEP
98304:t287e9Cg7HpxtbymElTE89gcTaqNTP3f8aPWIKz86PB3/dnDc5Fy/OIkvU:887ejpbyVlbD/evz8cxaFePks
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2328 KA-LicenseKey_x86_x64_v1.1.exe Token: 33 2820 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2820 AUDIODG.EXE Token: 33 2820 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2820 AUDIODG.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ghosty Permanent Spoofer\KA-LicenseKey_x86_x64_v1.1.exe"C:\Users\Admin\AppData\Local\Temp\Ghosty Permanent Spoofer\KA-LicenseKey_x86_x64_v1.1.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2328
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5201⤵
- Suspicious use of AdjustPrivilegeToken
PID:2820