Overview

overview

10

Static

static

3

Ghosty Per...er.rar

windows7-x64

10

Ghosty Per...er.rar

windows10-2004-x64

1

Ghosty Per...FN.exe

windows7-x64

10

Ghosty Per...FN.exe

windows10-2004-x64

10

Ghosty Per....1.exe

windows7-x64

1

Ghosty Per....1.exe

windows10-2004-x64

1

Ghosty Per....1.exe

windows7-x64

1

Ghosty Per....1.exe

windows10-2004-x64

1

Ghosty Per...ry.dll

windows7-x64

5

Ghosty Per...ry.dll

windows10-2004-x64

5

Ghosty Per...64.dll

windows7-x64

1

Ghosty Per...64.dll

windows10-2004-x64

1

Ghosty Per...on.dll

windows7-x64

1

Ghosty Per...on.dll

windows10-2004-x64

1

Ghosty Per...ec.dll

windows7-x64

1

Ghosty Per...ec.dll

windows10-2004-x64

1

Ghosty Per...z2.dll

windows7-x64

1

Ghosty Per...z2.dll

windows10-2004-x64

1

Ghosty Per...pe.dll

windows7-x64

1

Ghosty Per...pe.dll

windows10-2004-x64

1

Ghosty Per...ui.ini

windows7-x64

3

Ghosty Per...ui.ini

windows10-2004-x64

1

Ghosty Per...16.dll

windows7-x64

1

Ghosty Per...16.dll

windows10-2004-x64

1

Ghosty Per...rts.sh

windows7-x64

3

Ghosty Per...rts.sh

windows10-2004-x64

3

Ghosty Per...th.sln

windows7-x64

3

Ghosty Per...th.sln

windows10-2004-x64

3

Ghosty Per...th.xml

windows7-x64

3

Ghosty Per...th.xml

windows10-2004-x64

1

Ghosty Per...ilters

windows7-x64

3

Ghosty Per...ilters

windows10-2004-x64

3

Analysis

  • max time kernel
    95s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-01-2025 22:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Ghosty Permanent Spoofer/server/EmuAuth/EmuAuth.xml

  • Size

    7KB

  • MD5

    72dd431cf325ada32e9560ddb65a659e

  • SHA1

    12e726f8f3c9721fcc18946c0908b17bf1f18997

  • SHA256

    503307a798fd4b15280f619f66117b7d99887f9c159b1d90e540bdce6c5fe3d9

  • SHA512

    83e35b1fec8ef8445f4c652becf207b3cff445b87c5b32761442a3d176c5e9de7e618626ef77e9b34cbf4b5cd8dfd1e23bff6e8cdbe43aaec7e9e90f7a6cfd5d

  • SSDEEP

    96:Z0/zcpU1fNOw7FO7bw7aOL2YyaLbyaLMyaL6yaLDmzA7/ePPcrAf/eWPcKfA7/ep:e/zcmls4hN/YPce/JPct/gPcL/xPcn

Score
1/10

Malware Config

Signatures

Processes

  • C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
    "C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb open "C:\Users\Admin\AppData\Local\Temp\Ghosty Permanent Spoofer\server\EmuAuth\EmuAuth.xml"
    1⤵
      PID:2148

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/2148-1-0x00007FFAB51ED000-0x00007FFAB51EE000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2148-0-0x00007FFA751D0000-0x00007FFA751E0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2148-2-0x00007FFAB5150000-0x00007FFAB5345000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/2148-3-0x00007FFAB5150000-0x00007FFAB5345000-memory.dmp

      Filesize

      2.0MB

      Download

    • memory/2148-4-0x00007FFAB5150000-0x00007FFAB5345000-memory.dmp

      Filesize

      2.0MB

      Download