bd3e94c6d782e4eb0e129b8f146ddec1555ec7a7996da7b205d1a0319f2fb311

General

Target
Ghost-Windows.zip
Size 51.5MB
Sample260712-b5ry9aby3m
SHA256 bd3e94c6d782e4eb0e129b8f146ddec1555ec7a7996da7b205d1a0319f2fb311
MD5 d968f4a6e9e6d3e5fc3e86e7ba29e34c
SHA1 c550350f40f73c4a06b1e0e91a90f314c0d428d5
SHA512 d525612c00b7caaca7c62b7637176045c80de556cf62d0d555498998917744ea91fc8e8013111dd0a13a9708554382a30011f945042147c5678cb25a81c38c9b
SSDEEP 1572864:f/e276e8LoTDZs6Qj7AviVWDmY3qG0E+ggFxzqZAr:f/e27B80Tm6e70iVkmY3qG0E+gIGY
TLSH
T16BC733FFC4BD8C67FA621FBD338F5312448CD6226313299336A047647D62665922BE4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  Ghost-Windows.zip
- Size 51.5MB
- SHA256 bd3e94c6d782e4eb0e129b8f146ddec1555ec7a7996da7b205d1a0319f2fb311
- MD5 d968f4a6e9e6d3e5fc3e86e7ba29e34c
- SHA1 c550350f40f73c4a06b1e0e91a90f314c0d428d5
- SHA512 d525612c00b7caaca7c62b7637176045c80de556cf62d0d555498998917744ea91fc8e8013111dd0a13a9708554382a30011f945042147c5678cb25a81c38c9b
- SSDEEP 1572864:f/e276e8LoTDZs6Qj7AviVWDmY3qG0E+ggFxzqZAr:f/e27B80Tm6e70iVkmY3qG0E+gIGY
- TLSH
  T16BC733FFC4BD8C67FA621FBD338F5312448CD6226313299336A047647D62665922BE4E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1
- Target
  Ghost-Windows/ghost-main/.venv/Lib/site-packages/pip/_internal/network/cache.py
- Size 4KB
- SHA256 926457290ac6f44dbac50463db5d4b1de106a4383f4a5614f439f57c9f8031e2
- MD5 4dd71e5c48143e57fd41a87be19b0a0e
- SHA1 f025151c097e8656d8852b32d8d04c672b198f33
- SHA512 cf1fe510a3b2fba936a1bc998cb4c92630d711a33ad69ccaf51c5dc8be9ef18a0d7c13b00ee15c1cb0e35a81012cf9501bf08d0e55882fc49ae6176ae59f98eb
- SSDEEP 96:cDe8+Vt8CLtSKYrAdjB98ic5XENd02jzKvopHQd02tlA:cD4HpplccPjzKvopH6PtlA
- TLSH
  T188A16F53978A5A6386C3C7B14B4BD9A22604F9F75BA84078BC6C53680F408FC84E7EF0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral2