General

  • Target
    Ghosty Permanent Spoofer (1).rar
  • Size 33.5MB
  • Sample250102-kshdqatra1
  • SHA256 873b3f4e9bcdf5c69e3928012df2b4d5fb94cb964f89ba842bdeb575178e031b
  • MD5 SHA1 SHA512 SSDEEP
Score
3/10

Malware Config

Signatures

  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Unsigned PE 13 IoCs

    Checks for missing Authenticode signature.

File Explorer

  • Ghosty Permanent Spoofer (1).rar
    .rar 33.5MB
  • Ghosty Permanent Spoofer/Application secret.txt
    64B
  • Ghosty Permanent Spoofer/GHOSTYFN.exe
    .exe 6.1MB
  • Ghosty Permanent Spoofer/KA-LicenseKey_x86_x64_v1.1.exe
    .exe 5.3MB
  • Ghosty Permanent Spoofer/KA-MemIntegrity_x86_x64_v1.1.exe
    .exe 351KB
  • Ghosty Permanent Spoofer/SafeGuard-Library.dll
    .dll 12.5MB
  • Ghosty Permanent Spoofer/VMProtectSDK64.dll
    .dll 116KB
  • Ghosty Permanent Spoofer/brotlicommon.dll
    .dll .js 134KB
  • Ghosty Permanent Spoofer/brotlidec.dll
    .dll 49KB
  • Ghosty Permanent Spoofer/bz2.dll
    .dll 74KB
  • Ghosty Permanent Spoofer/freetype.dll
    .dll 675KB
  • Ghosty Permanent Spoofer/imgui.ini
    96B
  • Ghosty Permanent Spoofer/libpng16.dll
    .dll 197KB
  • Ghosty Permanent Spoofer/server/Certificates/generate-certs.sh
    726B
  • Ghosty Permanent Spoofer/server/EmuAuth.sln
    887B
  • Ghosty Permanent Spoofer/server/EmuAuth/EmuAuth.vcxproj
    .xml 7KB
  • Ghosty Permanent Spoofer/server/EmuAuth/EmuAuth.vcxproj.filters
    1KB
  • Ghosty Permanent Spoofer/server/EmuAuth/EmuAuth.vcxproj.user
    168B
  • Ghosty Permanent Spoofer/server/EmuAuth/Library/hmac_sha256.c
    2KB
  • Ghosty Permanent Spoofer/server/EmuAuth/Library/hmac_sha256.h
    913B
  • Ghosty Permanent Spoofer/server/EmuAuth/Library/httplib.h
    365KB
  • Ghosty Permanent Spoofer/server/EmuAuth/Library/json.hpp
    898KB
  • Ghosty Permanent Spoofer/server/EmuAuth/Library/sha256.c
    10KB
  • Ghosty Permanent Spoofer/server/EmuAuth/Library/sha256.h
    3KB
  • Ghosty Permanent Spoofer/server/EmuAuth/Source/Console.cpp
    2KB
  • Ghosty Permanent Spoofer/server/EmuAuth/Source/Console.h
    725B
  • Ghosty Permanent Spoofer/server/EmuAuth/Source/Entry.cpp
    2KB
  • Ghosty Permanent Spoofer/server/EmuAuth/Source/Global.h
    473B
  • Ghosty Permanent Spoofer/server/EmuAuth/Source/Handler.cpp
    12KB
  • Ghosty Permanent Spoofer/server/EmuAuth/Source/Handler.h
    1KB
  • Ghosty Permanent Spoofer/server/EmuAuth/Source/Utils.cpp
    1011B
  • Ghosty Permanent Spoofer/server/EmuAuth/Source/Utils.h
    168B
  • Ghosty Permanent Spoofer/server/Leaks/1337.rar
    .rar 10.2MB
  • 1337.sln
    1KB
  • 1337/.vs/1337/FileContentIndex/5df60766-ddc5-411e-9c11-306943585f51.vsidx
    17KB
  • 1337/.vs/1337/FileContentIndex/8c8e31b7-3aa8-4de3-b2aa-0a5b85196e75.vsidx
    107B
  • 1337/.vs/1337/FileContentIndex/9a5d9b03-b82f-4aad-820c-a12b7e337436.vsidx
    107B
  • 1337/.vs/1337/FileContentIndex/b8c15f49-5eb2-43c8-a1e7-9a53845423d3.vsidx
    139KB
  • 1337/.vs/1337/FileContentIndex/f28a8a9a-2460-474f-a4c0-593f0366b22e.vsidx
    107B
  • 1337/.vs/1337/v17/Browse.VC.db
    456KB
  • 1337/.vs/1337/v17/Solution.VC.db
    428KB
  • 1337/.vs/EmuAuth/FileContentIndex/72ea2ae5-ad94-4065-8d7c-cf39542831a0.vsidx
    146KB
  • 1337/.vs/EmuAuth/v17/.suo
    5KB
  • 1337/.vs/EmuAuth/v17/Browse.VC.db
    240KB
  • 1337/.vs/EmuAuth/v17/Solution.VC.db
    428KB
  • 1337/1337.filters
    1KB
  • 1337/1337.user
    168B
  • 1337/1337.vcxproj
    .xml 7KB
  • 1337/1337.vcxproj.user
    168B
  • 1337/Library/hmac_sha256.c
    2KB
  • 1337/Library/hmac_sha256.h
    913B
  • 1337/Library/httplib.h
    365KB
  • 1337/Library/json.hpp
    898KB
  • 1337/Library/libcurl.lib
    1.8MB
  • 1337/Library/sha256.c
    10KB
  • 1337/Library/sha256.h
    3KB
  • 1337/Source/Console.cpp
    1KB
  • 1337/Source/Console.h
    704B
  • 1337/Source/Entry.cpp
    2KB
  • 1337/Source/Global.h
    663B
  • 1337/Source/Handler.cpp
    12KB
  • 1337/Source/Handler.h
    1013B
  • 1337/Source/Utils.cpp
    454B
  • 1337/Source/Utils.h
    115B
  • 1337/convert/certserial
    5B
  • 1337/convert/convert.rar
    .rar 9KB
  • certserial
    5B
  • crlnumber
    3B
  • generate-certs.sh
    726B
  • keyauth.win.conf
    322B
  • keyauth.win.crt
    1KB
  • keyauth.win.csr
    1014B
  • keyauth.win.key
    1KB
  • rootCA.crt
    1KB
  • rootCA.key
    3KB
  • rootCA.pem
    1KB
  • 1337/convert/crlnumber
    3B
  • 1337/convert/generate-certs.sh
    726B
  • 1337/convert/keyauth.win.conf
    322B
  • 1337/convert/keyauth.win.crt
    1KB
  • 1337/convert/keyauth.win.csr
    1014B
  • 1337/convert/keyauth.win.key
    1KB
  • 1337/convert/rootCA.crt
    1KB
  • 1337/convert/rootCA.key
    3KB
  • 1337/convert/rootCA.pem
    1KB
  • 1337/x64/Release/1337.exe.recipe
    294B
  • 1337/x64/Release/1337.iobj
    14.5MB
  • 1337/x64/Release/1337.ipdb
    3.0MB
  • 1337/x64/Release/1337.log
    356B
  • 1337/x64/Release/1337.tlog/1337.lastbuildstate
    162B
  • 1337/x64/Release/1337.tlog/CL.command.1.tlog
    5KB
  • 1337/x64/Release/1337.tlog/CL.read.1.tlog
    221KB
  • 1337/x64/Release/1337.tlog/CL.write.1.tlog
    2KB
  • 1337/x64/Release/1337.tlog/Cl.items.tlog
    692B
  • 1337/x64/Release/1337.tlog/link.command.1.tlog
    2KB
  • 1337/x64/Release/1337.tlog/link.read.1.tlog
    5KB
  • 1337/x64/Release/1337.tlog/link.secondary.1.tlog
    479B
  • 1337/x64/Release/1337.tlog/link.write.1.tlog
    936B
  • 1337/x64/Release/Console.obj
    9.8MB
  • 1337/x64/Release/Entry.obj
    9.5MB
  • 1337/x64/Release/Handler.obj
    10.2MB
  • 1337/x64/Release/Utils.obj
    9.8MB
  • 1337/x64/Release/hmac_sha256.obj
    82KB
  • 1337/x64/Release/sha256.obj
    85KB
  • 1337/x64/Release/vc143.pdb
    5.3MB
  • Ghosty Permanent Spoofer/server/Leaks/readme.txt
    244B
  • Ghosty Permanent Spoofer/server/README.md
    2KB
  • Ghosty Permanent Spoofer/server/x64/Release/Emulator.exe
    .exe 596KB
  • Ghosty Permanent Spoofer/server/x64/Release/Emulator.pdb
    12.4MB
  • Ghosty Permanent Spoofer/server/x64/Release/certs/certserial
    5B
  • Ghosty Permanent Spoofer/server/x64/Release/certs/crlnumber
    3B
  • Ghosty Permanent Spoofer/server/x64/Release/certs/keyauth.win.conf
    322B
  • Ghosty Permanent Spoofer/server/x64/Release/certs/keyauth.win.crt
    1KB
  • Ghosty Permanent Spoofer/server/x64/Release/certs/keyauth.win.csr
    1014B
  • Ghosty Permanent Spoofer/server/x64/Release/certs/keyauth.win.key
    1KB
  • Ghosty Permanent Spoofer/server/x64/Release/certs/rootCA.crt
    1KB
  • Ghosty Permanent Spoofer/server/x64/Release/certs/rootCA.key
    3KB
  • Ghosty Permanent Spoofer/server/x64/Release/certs/rootCA.pem
    1KB
  • Ghosty Permanent Spoofer/server/x64/Release/libcrypto-3-x64.dll
    .dll 4.6MB
  • Ghosty Permanent Spoofer/server/x64/Release/libssl-3-x64.dll
    .dll 537KB
  • Ghosty Permanent Spoofer/zlib1.dll
    .dll 88KB

Ghosty Permanent Spoofer (1).rar

  • SHA256 873b3f4e9bcdf5c69e3928012df2b4d5fb94cb964f89ba842bdeb575178e031b
  • MD5 SHA1 SHA512 SSDEEP