ghostlocker | 8b758ccdfbfa5ff3a0b67b2063c2397531cf0f7b3d278298da76528f443779e9

Sharing

Copy URL Twitter E-mail

General

Target
8b758ccdfbfa5ff3a0b67b2063c2397531cf0f7b3d278298da76528f443779e9
Size 7.0MB
Sample260626-xerrfsd14s
SHA256 8b758ccdfbfa5ff3a0b67b2063c2397531cf0f7b3d278298da76528f443779e9
MD5 8ad67a1b7a5f2428c93f7a13a398e39c
SHA1 d4f71fc5479a02c8ff57c90fc67b948adb5604e0
SHA512 57475600b531b3b80936bf3015d5a38bba61cfac793cb4de9985d4e4b0afdc12f7f591ecdc8e9f9fd2dcb7b0e3d2fe851f33f80ba2888730774f73ac8ab34b5c
SSDEEP 98304:UNmXStQHQu1OCUPExButIaUgF246UZ0R+xp2exp2U3KQ5KntG:2Bt2Qu1OAxW2kyRU913KQ
TLSH
T193767C47EC9585A9C1AAE334C9A292537A717C485B3123D32F90F7382F77BD06AB9350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

ransomware ghostlocker

Malware Config

Extracted

Family

ghostlocker

http://94.103.91.246/addInfection

Signatures

Family: Ghostlocker
Windows focus ransomware written in golang.
ransomware ghostlocker

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8b758ccdfbfa5ff3a0b67b2063c2397531cf0f7b3d278298da76528f443779e9

File Explorer

8b758ccdfbfa5ff3a0b67b2063c2397531cf0f7b3d278298da76528f443779e9

.exe 7.0MB

8b758ccdfbfa5ff3a0b67b2063c2397531cf0f7b3d278298da76528f443779e9

IMPHASH 4f2f006e2ecf7172ad368f8289dc96c1
SHA256 8b758ccdfbfa5ff3a0b67b2063c2397531cf0f7b3d278298da76528f443779e9
MD5 8ad67a1b7a5f2428c93f7a13a398e39c
SHA1 d4f71fc5479a02c8ff57c90fc67b948adb5604e0
SHA512 57475600b531b3b80936bf3015d5a38bba61cfac793cb4de9985d4e4b0afdc12f7f591ecdc8e9f9fd2dcb7b0e3d2fe851f33f80ba2888730774f73ac8ab34b5c
SSDEEP 98304:UNmXStQHQu1OCUPExButIaUgF246UZ0R+xp2exp2U3KQ5KntG:2Bt2Qu1OAxW2kyRU913KQ
TLSH
T193767C47EC9585A9C1AAE334C9A292537A717C485B3123D32F90F7382F77BD06AB9350
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

426624

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

205KB

Virtual Size

573KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

53KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

168B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

297B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

405KB

Virtual Size

404KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/32

Size

86KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/46

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/65

Size

706KB

Virtual Size

706KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/78

Size

534KB

Virtual Size

534KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/90

Size

151KB

Virtual Size

150KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

40KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

318KB

Virtual Size

318KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

8b758ccdfbfa5ff3a0b67b2063c2397531cf0f7b3d278298da76528f443779e9

kernel32

generic