Distribution[.]rar

Sharing

Copy URL Twitter E-mail

General

Target
Distribution.rar
Size 1.4MB
Sample260511-rl1eaab19s
SHA256 82d274edb78998643de1a2f42bc069518f3192ab7e3b9ddd1ebb16f573d11adf
MD5 46a2d9af941eac8b5750502fdafe1fa6
SHA1 c54e4ab13b9687c8e2fd948e8304705f16d29a36
SHA512 b7a964576b47b04be5524300059322918f61215c4985fdd008f409973b9fe93a6bd3990b54fc8d1c904596991cfd65edd5b0b095f3c42d0a2c62a91ef663cded
SSDEEP 24576:Xxpir1NVMNHcFcqmJb1nuT6hqkzdOxBFUELQ3N2rhA6dQQbM0NvRrVJd3:XxpiPVMNHiC1S6PdORUEM3N21CaM0Nvr
TLSH
T13A6533D47E12F0769A55DCA1F0AD0FFECD437CA42F860AFBE6618C699C5000117ED99A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Distribution/ghostmode.exe

File Explorer

Distribution.rar

.rar 1.4MB
Distribution/README.txt

1KB
Distribution/ghostmode.exe

.exe 2.9MB

Distribution.rar

SHA256 82d274edb78998643de1a2f42bc069518f3192ab7e3b9ddd1ebb16f573d11adf
MD5 46a2d9af941eac8b5750502fdafe1fa6
SHA1 c54e4ab13b9687c8e2fd948e8304705f16d29a36
SHA512 b7a964576b47b04be5524300059322918f61215c4985fdd008f409973b9fe93a6bd3990b54fc8d1c904596991cfd65edd5b0b095f3c42d0a2c62a91ef663cded
SSDEEP 24576:Xxpir1NVMNHcFcqmJb1nuT6hqkzdOxBFUELQ3N2rhA6dQQbM0NvRrVJd3:XxpiPVMNHiC1S6PdORUEM3N21CaM0Nvr
TLSH
T13A6533D47E12F0769A55DCA1F0AD0FFECD437CA42F860AFBE6618C699C5000117ED99A
MD5 SHA1 SHA512 SSDEEP TLSH

Distribution/ghostmode.exe

IMPHASH 2c7ee90e627cf7443a849fc4e253040c
SHA256 398dbf1614960506d1a891c1efcc7e41c597b71ccb9cece5c786702b48c9e571
MD5 1ea76de8bd46a5ea1fa363c6dc595d1c
SHA1 b8215c565982f43514f0aac948287620291b6383
SHA512 b22e7d2d29293d0d705aac5a49b1d2ba818c067a1bd5765533280f9fc24565746983470cc9265411ca7c619f6b01d98d45100a6b10d5ad52cc62821bd820a720
SSDEEP 49152:F8S7QiQK4Qk3FMVmtT8+HE609japlEPwMLUox6rIEKxvi+XA2d:XQqeplEPH2yJiMrd
TLSH
T10FE5DF47B3A246EDD03AD978C9429A13E3B1B8001731A1DF6BD40D9ACF976E05EBE741
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

923092

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\marti\Downloads\ghostmode2\ghostmode2\src\x64\Release\ghostmode.pdb

d3dx9_43

D3DXMatrixInverse D3DXVec3Transform D3DXMatrixTranspose D3DXVec3Normalize

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3d11

D3D11CreateDeviceAndSwapChain

kernel32

Beep GetCurrentProcessId CreateRemoteThread GetCurrentProcess GetTickCount64 ExitProcess GetTickCount VirtualProtect GetSystemInfo FlushInstructionCache GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock GetLocaleInfoA LoadLibraryA QueryPerformanceFrequency QueryPerformanceCounter CreateRemoteThreadEx WriteProcessMemory VirtualAlloc GetProcessId DuplicateHandle CreateThread OpenThread IsDebuggerPresent CheckRemoteDebuggerPresent SizeofResource TerminateProcess LockResource LoadResource K32GetModuleFileNameExA LocalFree GetModuleHandleW GetTempPathW WaitForSingleObject CreateProcessW GetTempFileNameW MultiByteToWideChar AcquireSRWLockExclusive ReleaseSRWLockExclusive FindFirstFileExW FindNextFileW GetFileAttributesExW SetFileInformationByHandle CreateFile2 AreFileApisANSI OpenProcess GetModuleHandleA Sleep ReadProcessMemory VirtualProtectEx GetModuleFileNameW GetFileInformationByHandleEx FormatMessageA GetLocaleInfoEx WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead Module32First Module32Next VirtualFreeEx VirtualAllocEx FreeLibrary GetProcAddress CloseHandle GetLastError CreateToolhelp32Snapshot SleepConditionVariableSRW GetCurrentThreadId GetCurrentDirectoryW CreateDirectoryW FindClose FindResourceW FindFirstFileW

user32

IsChild IsWindow GetWindowLongA DefWindowProcW GetSystemMetrics GetWindowThreadProcessId IsWindowVisible GetWindowTextA EnumWindows FindWindowW SetWindowsHookA GetWindowTextLengthA GetKeyState GetMessageExtraInfo GetAncestor ScreenToClient GetCapture TrackMouseEvent GetKeyboardLayout SetCapture SetCursor IsWindowUnicode ReleaseCapture SetCursorPos GetCursorPos OpenClipboard CloseClipboard LoadCursorA UpdateWindow GetAsyncKeyState GetForegroundWindow FindWindowA PostQuitMessage GetWindowLongPtrA mouse_event PeekMessageA GetClientRect TranslateMessage SetLayeredWindowAttributes DefWindowProcA UnhookWindowsHookEx MoveWindow GetMonitorInfoA MessageBoxA SetWindowDisplayAffinity EmptyClipboard GetClipboardData SetClipboardData DispatchMessageA GetWindowRect DestroyWindow SetWindowPos SetWindowLongPtrW EnumDisplayMonitors CreateWindowExW UnregisterClassW GetWindowLongPtrW RegisterClassExW ShowWindow SetWindowLongA ClientToScreen

advapi32

QueryServiceStatus CloseServiceHandle GetTokenInformation OpenProcessToken AdjustTokenPrivileges ConvertSidToStringSidA RegGetValueA OpenServiceA ControlService OpenSCManagerA

ole32

CoInitializeEx

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?widen@?$ctype@_W@std@@QEBA_WD@Z ?tolower@?$ctype@_W@std@@QEBA_W_W@Z ?is@?$ctype@_W@std@@QEBA_NF_W@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ??7ios_base@std@@QEBA_NXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Winerror_map@std@@YAHH@Z ?_Syserror_map@std@@YAPEBDH@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z __crtLCMapStringW ??1_Locinfo@std@@QEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Xlength_error@std@@YAXPEBD@Z ?uncaught_exceptions@std@@YAHXZ ?_Xbad_alloc@std@@YAXXZ ?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A ?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z ?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z ?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z ?good@ios_base@std@@QEBA_NXZ _Query_perf_frequency _Query_perf_counter ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_lock _Mtx_unlock ?_Random_device@std@@YAIXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ??Bios_base@std@@QEBA_NXZ _Wcscoll ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?id@?$ctype@_W@std@@2V0locale@2@A ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?_Xbad_function_call@std@@YAXXZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?id@?$collate@_W@std@@2V0locale@2@A ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z _Wcsxfrm

dwmapi

DwmExtendFrameIntoClientArea

wininet

InternetSetOptionA HttpAddRequestHeadersA HttpSendRequestA InternetConnectA InternetOpenA InternetOpenUrlA InternetReadFile HttpOpenRequestA InternetCloseHandle

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

d3dcompiler_43

D3DCompile

bcrypt

BCryptOpenAlgorithmProvider BCryptFinishHash BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData BCryptDestroyHash

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __current_exception __C_specific_handler memset memmove memcpy memcmp memchr wcsstr __std_exception_destroy __std_exception_copy __std_terminate __std_type_info_compare strchr __RTtypeid strstr __current_exception_context

api-ms-win-crt-runtime-l1-1-0

_set_app_type _errno _beginthreadex system terminate _register_thread_local_exe_atexit_callback _c_exit _exit _initterm_e _initterm abort _get_narrow_winmain_command_line _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe exit

api-ms-win-crt-stdio-l1-1-0

setvbuf ungetc fsetpos _fseeki64 _set_fmode _get_stream_buffer_pointers __stdio_common_vsprintf fwrite __stdio_common_vsscanf __p__commode fgetpos fgetc __stdio_common_vsprintf_s fclose fflush ftell __stdio_common_vfprintf fseek __acrt_iob_func fputc _wfopen fread

api-ms-win-crt-convert-l1-1-0

strtol strtod atof strtoull strtoll

api-ms-win-crt-heap-l1-1-0

realloc free _callnewh _set_new_mode malloc

api-ms-win-crt-string-l1-1-0

isalnum strcpy_s _wcsicmp tolower toupper strcmp strlen strncmp strncpy wcslen

api-ms-win-crt-utility-l1-1-0

qsort rand

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-environment-l1-1-0

_wgetenv getenv

api-ms-win-crt-math-l1-1-0

sinf powf _dclass cosf ceilf _dsign logf log fmodf atan2f _hypotf pow __setusermatherr sqrtf acosf

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func localeconv _configthreadlocale ___lc_locale_name_func

api-ms-win-crt-time-l1-1-0

_time64