General
- Target RunningGhost_Setup.7z
- Size 79.5MB
- Sample260705-g58jwsaw71
- SHA256 2832f042255f8735dde7df01b5ae8bd6098949ca9551284bcc106bda840aec43
Malware Config
Targets
-
- Target RunningGhost_Setup.exe
- Size 79.5MB
- SHA256 4d74a2df37d961af81255fc64ef1e49a5805bb1eec98513fbb93295fb8c482f2
Score7/10-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Executes dropped EXE
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates processes with tasklist
-
- Target $PLUGINSDIR/StdUtils.dll
- Size 100KB
- SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
Score3/10 -
- Target $PLUGINSDIR/System.dll
- Size 12KB
- SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target LICENSES.chromium.html
- Size 8.4MB
- SHA256 ee3b1ab8794c749673ce9bd2dd302f12d69f0a1a4adfe40a64247746cc311829
Score4/10 -
- Target RunningGhost.exe
- Size 158.3MB
- SHA256 3aba653e92c4907ea4a8d1e1dc6ec71964faaa3d7ae129523380c51865d746fc
Score7/10-
Clipboard Data
Adversaries may collect data stored in the clipboard from users copying information within or between applications.
-
Loads dropped DLL
-
Reads user/profile data of web browsers
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates processes with tasklist
-
- Target d3dcompiler_47.dll
- Size 4.7MB
- SHA256 7353f25dc5cf84d09894e3e0461cef0e56799adbc617fce37620ca67240b547d
Score1/10 -
- Target ffmpeg.dll
- Size 2.7MB
- SHA256 64dbe39b8bced2d4f2ddd727e914f17a385366cac4d4e63118915b2b093d90c9
Score1/10 -
- Target libEGL.dll
- Size 469KB
- SHA256 f37e1330f5213a7171d8d227300b431dee8ba4f5809c86dd88240ce440724d0a
Score1/10 -
- Target libGLESv2.dll
- Size 7.1MB
- SHA256 11c02af9eb233ffd13c8ffae49aea486c97d1f631f560822bbd129a6e14107b9
Score1/10 -
- Target resources/elevate.exe
- Size 105KB
- SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
Score3/10 -
- Target vk_swiftshader.dll
- Size 4.9MB
- SHA256 2a711ae49eea54fd2d7e213af228ffaf57f5a76d8c8d9c225f4b055198f47bc8
Score1/10 -
- Target vulkan-1.dll
- Size 917KB
- SHA256 52ba3ca2a03fd547e0ca45d8338265f4c5898a7c0e941dc90c80e9e5e9fbcebf
Score1/10 -
- Target $PLUGINSDIR/nsis7z.dll
- Size 424KB
- SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
Score3/10
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Active Setup
1Event Triggered Execution
1Netsh Helper DLL
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Process Discovery
1Query Registry
5System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
2Internet Connection Discovery
1Wi-Fi Discovery
1System Time Discovery
1