Analysis
- user interaction
yes - max time kernel
14s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
25/05/2026, 16:49
General
- Target GhostKey.exe
- Size 88KB
- Sample260525-vbprksdw3k
- SHA256 6fd89f35b04cd072e81375af9ca9cc44786d01ebae3b7bbf53ad23e4098ebe46
Score
9/10
Malware Config
Signatures
- Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
- Looks for VMWare Tools registry key 2 TTPs 1 IoCs
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\GhostKey.exe"C:\Users\Admin\AppData\Local\Temp\GhostKey.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks for VirtualBox DLLs, possible anti-VM trick
- Suspicious behavior: EnumeratesProcesses