Ghosty Permanent Spoofer (1).rar
- SHA256 873b3f4e9bcdf5c69e3928012df2b4d5fb94cb964f89ba842bdeb575178e031b
Overview
overview
10Static
static
3Ghosty Per...FN.exe
windows7-x64
10Ghosty Per...FN.exe
windows10-2004-x64
10Ghosty Per....1.exe
windows7-x64
1Ghosty Per....1.exe
windows10-2004-x64
1Ghosty Per....1.exe
windows7-x64
1Ghosty Per....1.exe
windows10-2004-x64
1Ghosty Per...ry.dll
windows7-x64
5Ghosty Per...ry.dll
windows10-2004-x64
5Ghosty Per...64.dll
windows7-x64
1Ghosty Per...64.dll
windows10-2004-x64
1Ghosty Per...on.dll
windows7-x64
1Ghosty Per...on.dll
windows10-2004-x64
1Ghosty Per...ec.dll
windows7-x64
1Ghosty Per...ec.dll
windows10-2004-x64
1Ghosty Per...z2.dll
windows7-x64
1Ghosty Per...z2.dll
windows10-2004-x64
1Ghosty Per...pe.dll
windows7-x64
1Ghosty Per...pe.dll
windows10-2004-x64
1Ghosty Per...16.dll
windows7-x64
1Ghosty Per...16.dll
windows10-2004-x64
1Ghosty Per...rts.sh
windows7-x64
3Ghosty Per...rts.sh
windows10-2004-x64
3generate-certs.sh
windows7-x64
3generate-certs.sh
windows10-2004-x64
31337/conve...rts.sh
windows7-x64
31337/conve...rts.sh
windows10-2004-x64
3Ghosty Per...or.exe
windows7-x64
1Ghosty Per...or.exe
windows10-2004-x64
1Ghosty Per...64.dll
windows7-x64
1Ghosty Per...64.dll
windows10-2004-x64
1Ghosty Per...64.dll
windows7-x64
1Ghosty Per...64.dll
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
Ghosty Permanent Spoofer/GHOSTYFN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Ghosty Permanent Spoofer/GHOSTYFN.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
Ghosty Permanent Spoofer/KA-LicenseKey_x86_x64_v1.1.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
Ghosty Permanent Spoofer/KA-LicenseKey_x86_x64_v1.1.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
Ghosty Permanent Spoofer/KA-MemIntegrity_x86_x64_v1.1.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
Ghosty Permanent Spoofer/KA-MemIntegrity_x86_x64_v1.1.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Ghosty Permanent Spoofer/SafeGuard-Library.dll
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
Ghosty Permanent Spoofer/SafeGuard-Library.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
Ghosty Permanent Spoofer/VMProtectSDK64.dll
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
Ghosty Permanent Spoofer/VMProtectSDK64.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
Ghosty Permanent Spoofer/brotlicommon.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
Ghosty Permanent Spoofer/brotlicommon.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
Ghosty Permanent Spoofer/brotlidec.dll
Resource
win7-20240708-en
Behavioral task
behavioral14
Sample
Ghosty Permanent Spoofer/brotlidec.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
Ghosty Permanent Spoofer/bz2.dll
Resource
win7-20240729-en
Behavioral task
behavioral16
Sample
Ghosty Permanent Spoofer/bz2.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
Ghosty Permanent Spoofer/freetype.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
Ghosty Permanent Spoofer/freetype.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
Ghosty Permanent Spoofer/libpng16.dll
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
Ghosty Permanent Spoofer/libpng16.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
Ghosty Permanent Spoofer/server/Certificates/generate-certs.sh
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
Ghosty Permanent Spoofer/server/Certificates/generate-certs.sh
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
generate-certs.sh
Resource
win7-20241023-en
Behavioral task
behavioral24
Sample
generate-certs.sh
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
1337/convert/generate-certs.sh
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
1337/convert/generate-certs.sh
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
Ghosty Permanent Spoofer/server/x64/Release/Emulator.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
Ghosty Permanent Spoofer/server/x64/Release/Emulator.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
Ghosty Permanent Spoofer/server/x64/Release/libcrypto-3-x64.dll
Resource
win7-20241010-en
Behavioral task
behavioral30
Sample
Ghosty Permanent Spoofer/server/x64/Release/libcrypto-3-x64.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
Ghosty Permanent Spoofer/server/x64/Release/libssl-3-x64.dll
Resource
win7-20240708-en
Behavioral task
behavioral32
Sample
Ghosty Permanent Spoofer/server/x64/Release/libssl-3-x64.dll
Resource
win10v2004-20241007-en
Embeds OpenSSL, may be used to circumvent TLS interception.
| resource | yara_rule |
|---|---|
| static1/unpack001/Ghosty Permanent Spoofer/server/x64/Release/libcrypto-3-x64.dll | embeds_openssl |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/Ghosty Permanent Spoofer/GHOSTYFN.exe |
| unpack001/Ghosty Permanent Spoofer/KA-LicenseKey_x86_x64_v1.1.exe |
| unpack001/Ghosty Permanent Spoofer/KA-MemIntegrity_x86_x64_v1.1.exe |
| unpack001/Ghosty Permanent Spoofer/SafeGuard-Library.dll |
| unpack001/Ghosty Permanent Spoofer/VMProtectSDK64.dll |
| unpack001/Ghosty Permanent Spoofer/brotlicommon.dll |
| unpack001/Ghosty Permanent Spoofer/brotlidec.dll |
| unpack001/Ghosty Permanent Spoofer/bz2.dll |
| unpack001/Ghosty Permanent Spoofer/freetype.dll |
| unpack001/Ghosty Permanent Spoofer/libpng16.dll |
| unpack001/Ghosty Permanent Spoofer/server/x64/Release/Emulator.exe |
| unpack001/Ghosty Permanent Spoofer/server/x64/Release/libssl-3-x64.dll |
| unpack001/Ghosty Permanent Spoofer/zlib1.dll |
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=5, id=259, version=30795,
count=172, id=261, version=30795,
count=16, id=260, version=30795,
count=10, id=259, version=33808,
count=16, id=260, version=33808,
count=83, id=261, version=33808,
count=9, id=257, version=30795,
count=122, id=1, productName=Unmarked objects,
count=4, id=265, version=34120,
count=1, id=255, version=34120,
count=1, id=151,
count=1, id=258, version=34120,
Unsigned PE
Checks for missing Authenticode signature.
count=5, id=259, version=30795,
count=170, id=261, version=30795,
count=16, id=260, version=30795,
count=10, id=259, version=33808,
count=16, id=260, version=33808,
count=81, id=261, version=33808,
count=7, id=257, version=30795,
count=120, id=1, productName=Unmarked objects,
count=1, id=265, version=34120,
count=1, id=255, version=34120,
count=1, id=151,
count=1, id=258, version=34120,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=4, id=241, version=40116,
count=124, id=243, version=40116,
count=14, id=242, version=40116,
count=7, id=259, version=24123,
count=20, id=261, version=24123,
count=17, id=260, version=24123,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=90, id=1, productName=Unmarked objects,
count=2, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=256, productName=VS2015 UPD3.1 build 24215, version=24215,
count=1, id=255, productName=VS2015 UPD3 build 24210, version=24210,
count=1, id=258, productName=VS2015 UPD3.1 build 24215, version=24215,
Unsigned PE
Checks for missing Authenticode signature.
count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=33731,
count=2, id=259, version=33731,
count=7, id=260, version=33731,
count=11, id=261, version=33731,
count=2, id=257, version=30795,
count=35, id=1, productName=Unmarked objects,
count=6, id=260, version=33811,
count=1, id=256, version=33811,
count=1, id=255, version=33811,
count=1, id=258, version=33811,
Unsigned PE
Checks for missing Authenticode signature.
count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=33731,
count=4, id=259, version=33731,
count=8, id=260, version=33731,
count=12, id=261, version=33731,
count=2, id=257, version=30795,
count=3, id=257, version=33811,
count=45, id=1, productName=Unmarked objects,
count=4, id=260, version=33811,
count=1, id=256, version=33811,
count=1, id=255, version=33811,
count=1, id=258, version=33811,
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=33731,
count=3, id=253, version=33731,
count=4, id=259, version=33731,
count=8, id=260, version=33731,
count=13, id=261, version=33731,
count=2, id=257, version=30795,
count=52, id=1, productName=Unmarked objects,
count=7, id=260, version=33811,
count=1, id=256, version=33811,
count=1, id=255, version=33811,
count=1, id=258, version=33811,
Unsigned PE
Checks for missing Authenticode signature.
count=12, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=33731,
count=1, id=253, version=33731,
count=4, id=259, version=33731,
count=8, id=260, version=33731,
count=12, id=261, version=33731,
count=2, id=257, version=30795,
count=9, id=257, version=33811,
count=91, id=1, productName=Unmarked objects,
count=42, id=260, version=33811,
count=1, id=256, version=33811,
count=1, id=255, version=33811,
count=1, id=151,
count=1, id=258, version=33811,
Unsigned PE
Checks for missing Authenticode signature.
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=33731,
count=1, id=253, version=33731,
count=3, id=259, version=33731,
count=8, id=260, version=33731,
count=13, id=261, version=33731,
count=2, id=257, version=30795,
count=3, id=257, version=33811,
count=69, id=1, productName=Unmarked objects,
count=17, id=260, version=33811,
count=1, id=256, version=33811,
count=1, id=255, version=33811,
count=1, id=258, version=33811,
Unsigned PE
Checks for missing Authenticode signature.
count=5, id=259, version=30795,
count=185, id=261, version=30795,
count=17, id=260, version=30795,
count=4, id=257, version=30795,
count=10, id=259, version=33808,
count=17, id=260, version=33808,
count=96, id=261, version=33808,
count=5, id=257, version=33814,
count=205, id=1, productName=Unmarked objects,
count=6, id=264, version=34120,
count=1, id=255, version=34120,
count=1, id=258, version=34120,
Embeds OpenSSL
Embeds OpenSSL, may be used to circumvent TLS interception.
Dec 13, 2023
CN=Windscribe Limited,O=Windscribe Limited,L=Richmond Hill,ST=Ontario,C=CA
CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
count=18, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=30034,
count=11, id=261, version=30034,
count=8, id=260, version=30034,
count=4, id=259, version=30034,
count=11, id=257, version=27412,
count=197, id=1, productName=Unmarked objects,
count=1, id=259, version=30152,
count=921, id=260, version=30152,
count=1, id=256, version=30152,
count=1, id=255, version=30152,
count=1, id=258, version=30152,
Unsigned PE
Checks for missing Authenticode signature.
count=14, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=31935,
count=2, id=257, version=29395,
count=12, id=261, version=31935,
count=8, id=260, version=31935,
count=4, id=259, version=31935,
count=3, id=257, version=32217,
count=540, id=1, productName=Unmarked objects,
count=49, id=260, version=32217,
count=1, id=256, version=32217,
count=1, id=255, version=32217,
count=1, id=258, version=32217,
Unsigned PE
Checks for missing Authenticode signature.
count=8, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=257, version=33731,
count=4, id=253, version=33731,
count=3, id=259, version=33731,
count=8, id=260, version=33731,
count=12, id=261, version=33731,
count=2, id=257, version=30795,
count=49, id=1, productName=Unmarked objects,
count=15, id=260, version=33811,
count=1, id=256, version=33811,
count=1, id=255, version=33811,
count=1, id=151,
count=1, id=258, version=33811,