General
- Target Ghost.zip
- Size 102.2MB
- Sample260809-m8nxjsdr6v
- SHA256 e871e652193ddfb4b113479f3094b4a579fe4f9262abffdfab4549959c0183ab
Malware Config
Targets
-
- Target Ghost/Ghost.exe
- Size 1.7MB
- SHA256 dcb07928f2b91f05ee022505a2c0137e185bd260ec71b00e8dc7ee2f282a9108
Score7/10-
Executes dropped EXE
-
Suspicious use of SetThreadContext
-
- Target Ghost/bin/temp/base_49.dll
- Size 779KB
- SHA256 c91c6abdb9b4aa108ea71924eac70af5c220eaedaea3f3243160023e6bafea3d
Score1/10 -
- Target Ghost/bin/temp/build_128.dll
- Size 954KB
- SHA256 195c811a5ca141e3afe8f3fe784681300c3163ebfe0ce193cf3b3296e6d74506
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Ghost/bin/temp/cache_101.dll
- Size 667KB
- SHA256 22dde8d10690b5327a7263556dee68ea9788b5884ad079f395f2a7fd3f53bd41
Score1/10 -
- Target Ghost/bin/temp/cache_104.dll
- Size 572KB
- SHA256 9b1272833969475e1447e9eb48e447d67233ba15cb8c2267c186055044d9cfe8
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Ghost/bin/temp/cache_117.dll
- Size 901KB
- SHA256 2e81621bed339ee82a1b0bfabbd5f3494e0aa610388609e3e03fc21de3b9e76d
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Ghost/bin/temp/cache_130.dll
- Size 574KB
- SHA256 4d6e27fa90ffec15cd5bec2d90267fe6deeb32afbeac6c1c329ca7967d06c60d
Score1/10 -
- Target Ghost/bin/temp/cache_21.dll
- Size 579KB
- SHA256 4a4e156231bf97fe502a0ff9a26fd10f36a3bd95011738fb3f9d655fe7dc27a7
Score1/10 -
- Target Ghost/bin/temp/core_5.dll
- Size 888KB
- SHA256 c1e64d7b4f24528ab09dae03e73415daaad3375e49ffcf0c1fb5d3262b23db81
Score1/10 -
- Target Ghost/bin/temp/info_122.dll
- Size 689KB
- SHA256 31b55344cfaee4bb429e3a25c0e7c462f5040b70b3c3f27a3d947a3bbd538ddc
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Ghost/bin/temp/info_125.dll
- Size 716KB
- SHA256 d8ad31106d6e57986d4daceaf31001936e53192b4fbe702e4450e73c118f0cc4
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Ghost/bin/temp/input_11.dll
- Size 548KB
- SHA256 21d9f4a44af52eefca1e5c896ffca59cc317faf1e0abd444944d008d6690399a
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Ghost/bin/temp/lib_107.dll
- Size 728KB
- SHA256 1bad3f6b9f4144eec8d5dce2709f63e689519f225b9c6f8163b02991ee9d3164
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Ghost/bin/temp/lib_29.dll
- Size 799KB
- SHA256 6ea3a717413e8d2ebbda8593e588bf78d6e1befa484e19eefa34dd8096ab8d12
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Ghost/bin/temp/log_43.dll
- Size 986KB
- SHA256 39c9698246f1530887858c1abcae338af3d28fc65fbb89de48eafd4dc8124cfa
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target Ghost/bin/temp/module_121.dll
- Size 962KB
- SHA256 5a420a68f9f0b390035ffa411b057a51557a95a2c0dfa433e0b82eb1ba8703d1
Score1/10 -
- Target Ghost/bin/temp/output_63.dll
- Size 825KB
- SHA256 84a6ab0183cd9329df811e89ba902c3c4af895b8cd82c63d28d99873f3188f3f
Score1/10