Analysis
- max time kernel
18s - max time network
19s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
25/05/2026, 16:49
General
- Target GhostKey.exe
- Size 88KB
- Sample260525-vbprksdw3k
- SHA256 6fd89f35b04cd072e81375af9ca9cc44786d01ebae3b7bbf53ad23e4098ebe46
Score
9/10
Malware Config
Signatures
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\GhostKey.exe"C:\Users\Admin\AppData\Local\Temp\GhostKey.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks for VirtualBox DLLs, possible anti-VM trick
- Suspicious behavior: EnumeratesProcesses