Overview

overview

10

Static

static

3

Ghosty Per...FN.exe

windows7-x64

10

Ghosty Per...FN.exe

windows10-2004-x64

10

Ghosty Per....1.exe

windows7-x64

1

Ghosty Per....1.exe

windows10-2004-x64

1

Ghosty Per....1.exe

windows7-x64

1

Ghosty Per....1.exe

windows10-2004-x64

1

Ghosty Per...ry.dll

windows7-x64

5

Ghosty Per...ry.dll

windows10-2004-x64

5

Ghosty Per...64.dll

windows7-x64

1

Ghosty Per...64.dll

windows10-2004-x64

1

Ghosty Per...on.dll

windows7-x64

1

Ghosty Per...on.dll

windows10-2004-x64

1

Ghosty Per...ec.dll

windows7-x64

1

Ghosty Per...ec.dll

windows10-2004-x64

1

Ghosty Per...z2.dll

windows7-x64

1

Ghosty Per...z2.dll

windows10-2004-x64

1

Ghosty Per...pe.dll

windows7-x64

1

Ghosty Per...pe.dll

windows10-2004-x64

1

Ghosty Per...16.dll

windows7-x64

1

Ghosty Per...16.dll

windows10-2004-x64

1

Ghosty Per...rts.sh

windows7-x64

3

Ghosty Per...rts.sh

windows10-2004-x64

3

generate-certs.sh

windows7-x64

3

generate-certs.sh

windows10-2004-x64

3

1337/conve...rts.sh

windows7-x64

3

1337/conve...rts.sh

windows10-2004-x64

3

Ghosty Per...or.exe

windows7-x64

1

Ghosty Per...or.exe

windows10-2004-x64

1

Ghosty Per...64.dll

windows7-x64

1

Ghosty Per...64.dll

windows10-2004-x64

1

Ghosty Per...64.dll

windows7-x64

1

Ghosty Per...64.dll

windows10-2004-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    Ghosty Permanent Spoofer (1).rar
  • Size 33.5MB
  • Sample250102-kshdqatra1
  • SHA256 873b3f4e9bcdf5c69e3928012df2b4d5fb94cb964f89ba842bdeb575178e031b
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
orcusdefense_evasiondiscoveryratspywarestealer

Malware Config

Extracted

Family

  • orcus

C2

  • another-contains.gl.at.ply.gg

Mutex

  • a49af69032c94d6fa7c0d2639d32f038

Attributes
  • administration_rights_required

    false

  • anti_debugger

    false

  • anti_tcp_analyzer

    false

  • antivm

    false

  • autostart_method

    1

  • change_creation_date

    false

  • force_installer_administrator_privileges

    false

  • hide_file

    false

  • install

    false

  • installation_folder

    %appdata%\Microsoft\Speech\AudioDriver.exe

  • installservice

    false

  • keylogger_enabled

    false

  • newcreationdate

    12/24/2024 02:03:43

  • plugins

    AgUFyOzBvwKV1wLetwKoxrcNilV/bBUKRwBhAG0AZQByACAAVgBpAGUAdwAHAzEALgAyAEEgYgA2ADkAZgA0ADUAZQBiADYANgAxADYANAA2ADAAZgA5AGUAMQAwADIAMgBkADcANwA3ADMAMABmADAANwAzAAIAAAACAg==

  • reconnect_delay

    10000

  • registry_autostart_keyname

    Audio HD Driver

  • registry_hidden_autostart

    false

  • set_admin_flag

    false

  • tasksch_name

    Audio HD Driver

  • tasksch_request_highest_privileges

    false

  • try_other_autostart_onfail

    false

aes.plain

Targets

    • Target
      Ghosty Permanent Spoofer/GHOSTYFN.exe
    • Size 6.1MB
    • SHA256 4a513270a4d7e85bdc8dfe9adea3b190cfc055e562060c2be9389336333864a0
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    orcusdefense_evasiondiscoveryratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcus family

      orcus

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

      defense_evasion
    behavioral1behavioral2
    • Target
      Ghosty Permanent Spoofer/KA-LicenseKey_x86_x64_v1.1.exe
    • Size 5.3MB
    • SHA256 93679af51f96edfa02cabea6801aba4484a90449745e2aa78afbd3e13fc1e070
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral3behavioral4
    • Target
      Ghosty Permanent Spoofer/KA-MemIntegrity_x86_x64_v1.1.exe
    • Size 351KB
    • SHA256 b0080c00e9fbe13df87806bd20826eb9735a8b67f3f6aae58b3b370ed381003c
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral5behavioral6
    • Target
      Ghosty Permanent Spoofer/SafeGuard-Library.dll
    • Size 12.5MB
    • SHA256 4e3eca4adbe0c4fede28228239dd93bb866ecd0415569ede6464d796e8d1a3a8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    5/10

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral7behavioral8
    • Target
      Ghosty Permanent Spoofer/VMProtectSDK64.dll
    • Size 116KB
    • SHA256 ae22254e2b5c5557f35a170696d53e847018221dcd4cc70c153c36ecdd891f81
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral10behavioral9
    • Target
      Ghosty Permanent Spoofer/brotlicommon.dll
    • Size 134KB
    • SHA256 b9b868f703ccb61ec15d14dcc738c4a4eebcc59c2f827090e7ced2f91c9debd7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral11behavioral12
    • Target
      Ghosty Permanent Spoofer/brotlidec.dll
    • Size 49KB
    • SHA256 da4996a4d6b9e18c3ebce85b5fbd5666950e69e5d0e31afa2eef550c2671bd93
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral13behavioral14
    • Target
      Ghosty Permanent Spoofer/bz2.dll
    • Size 74KB
    • SHA256 c94f3302b33c45a35ba83448c111dd0138a49d6355c943af0ea40bc8014a991b
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral15behavioral16
    • Target
      Ghosty Permanent Spoofer/freetype.dll
    • Size 675KB
    • SHA256 9aa4d1356beedaad8f8879b49b76d1ff120dec210a1c0135ede8b9337ad0505d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral17behavioral18
    • Target
      Ghosty Permanent Spoofer/libpng16.dll
    • Size 197KB
    • SHA256 28f086ae4965dd262e000783a4fd8aebdce8eeeef8285db59984144e7a4c45d4
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral19behavioral20
    • Target
      Ghosty Permanent Spoofer/server/Certificates/generate-certs.sh
    • Size 726B
    • SHA256 a559dcd94b5dc389f518acd1f856e11e3146d1891a9026fb8691ff342836f447
    • MD5 SHA1 SHA512
    Score
    3/10
    discovery
    behavioral21behavioral22
    • Target
      generate-certs.sh
    • Size 726B
    • SHA256 a559dcd94b5dc389f518acd1f856e11e3146d1891a9026fb8691ff342836f447
    • MD5 SHA1 SHA512
    Score
    3/10
    discovery
    behavioral23behavioral24
    • Target
      1337/convert/generate-certs.sh
    • Size 726B
    • SHA256 a559dcd94b5dc389f518acd1f856e11e3146d1891a9026fb8691ff342836f447
    • MD5 SHA1 SHA512
    Score
    3/10
    discovery
    behavioral25behavioral26
    • Target
      Ghosty Permanent Spoofer/server/x64/Release/Emulator.exe
    • Size 596KB
    • SHA256 777e731543579910dc6d0dd5b15d71d46a50c401b1203cdd7cbacc79363ee5b8
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral27behavioral28
    • Target
      Ghosty Permanent Spoofer/server/x64/Release/libcrypto-3-x64.dll
    • Size 4.6MB
    • SHA256 5527ff18dd749687d886ef7f383463b6ce7bca66c773d6ff94f40190da853ebe
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral29behavioral30
    • Target
      Ghosty Permanent Spoofer/server/x64/Release/libssl-3-x64.dll
    • Size 537KB
    • SHA256 96dde73df4a2df72d5fc788e1ad99c6adf388cd42c2f874cf8d6a883a3654bf7
    • MD5 SHA1 SHA512 SSDEEP
    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Enterprise v15

Tasks

static1

Score
3/10

behavioral1

orcusdefense_evasiondiscoveryratspywarestealer
Score
10/10

behavioral2

orcusdefense_evasiondiscoveryratspywarestealer
Score
10/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
5/10

behavioral8

Score
5/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

Score
1/10

behavioral12

Score
1/10

behavioral13

Score
1/10

behavioral14

Score
1/10

behavioral15

Score
1/10

behavioral16

Score
1/10

behavioral17

Score
1/10

behavioral18

Score
1/10

behavioral19

Score
1/10

behavioral20

Score
1/10

behavioral21

discovery
Score
3/10

behavioral22

Score
3/10

behavioral23

discovery
Score
3/10

behavioral24

Score
3/10

behavioral25

discovery
Score
3/10

behavioral26

Score
3/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

Score
1/10

behavioral32

Score
1/10