Overview

overview

10

Static

static

3

GHOST FUD CRYPTER.exe

windows10-2004-x64

10

GHOST FUD CRYPTER.exe

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    898s
  • max time network
    868s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    24/08/2026, 00:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    GHOST FUD CRYPTER.exe
  • Size 9.5MB
  • Sample260824-aefymabe93
  • SHA256 339a880408b453df07d35dba3979144b2cee3a778bc3906e52d1b72acaf5b045
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasionpersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Users\Admin\AppData\Local\Temp\ransomNOTE.txt

Ransom Note
  • Hi! All your files are encrypted. -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised, rebooting/shutdown will cause you to lose files whitout the possibility of recovery and even god will not be able to help you, it could be files on the network belonging to other users, sure you want to take that responsibility? -- Our encryption algorithms are very strong and your files are very well protected, you can't hope to recover them whitout paying the ransom. The only way to get your files back is to follow the 4 steps below. As soon as the ransom will be paid, you will see the decryptor program on the Desktop folder. Do not try to recover your files whitout a decrypt program, you may damage them and then they will be impossible to recover. (If you dont know how to, just search it on YouTube, like How to download Exodus) 1.Download Exodus 2.Get some Bitcoin for 300$ (in USD) 3.Swap Bitcon to Monero 4.Send the Monero to this address: 4BKcz4x1tJg7Tqr2nKJ1Ug2totBBP54E9F8UkY79vK8nQaShnzFtPr872s6jGV3TRPMAGzrZdBG7UMa3XFar4fg49eHDw9W -- Oh, and if you decide you dont want to pay or take too much time, well all your files, and information we know about you WILL be transfered to the FBI. We are NOT joking, hurry up with the decision.

Signatures

  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 32 IoCs
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 2 IoCs
    defense_evasion
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\GHOST FUD CRYPTER.exe
    "C:\Users\Admin\AppData\Local\Temp\GHOST FUD CRYPTER.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2324
    • C:\Windows\system32\cmd.exe
      cmd /C "attrib +h C:\Users\Admin\Downloads\adiwejdiowejdoiewdeowedopwedxcmkedtmpScript.bat"
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • Suspicious use of WriteProcessMemory
      PID:3700
      • C:\Windows\system32\attrib.exe
        attrib +h C:\Users\Admin\Downloads\adiwejdiowejdoiewdeowedopwedxcmkedtmpScript.bat
        3⤵
        • Views/modifies file attributes
        PID:4708
    • C:\Users\Admin\Downloads\adiwejdiowejdoiewdeowedopwedxcmkedtmpScript.bat
      C:\Users\Admin\Downloads\adiwejdiowejdoiewdeowedopwedxcmkedtmpScript.bat
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4724
      • C:\Windows\system32\cmd.exe
        cmd /C "attrib +h C:\Users\Admin\Downloads\diwejdiowejdoiewdeowedopwedxcmkedtmpScript.bat"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:928
        • C:\Windows\system32\attrib.exe
          attrib +h C:\Users\Admin\Downloads\diwejdiowejdoiewdeowedopwedxcmkedtmpScript.bat
          4⤵
          • Views/modifies file attributes
          PID:3836
      • C:\Users\Admin\Downloads\diwejdiowejdoiewdeowedopwedxcmkedtmpScript.bat
        C:\Users\Admin\Downloads\diwejdiowejdoiewdeowedopwedxcmkedtmpScript.bat
        3⤵
        • Creates a file in the Startup directory
        • Executes dropped EXE
        • Drops desktop.ini file(s)
        PID:1592
      • C:\Windows\system32\notepad.exe
        notepad ransomNOTE.txt
        3⤵
          PID:1040

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          notificationsDB
          • Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\DesktopNotification\NotificationsDB\notificationsDB
          • Size 24KB
          • SHA256 0c01c88c866e39e9e85646f69a6080b925a330a4c24e1b654d75a2739fda23ad
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AdobeSysFnt19.lst
          • Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt19.lst
          • Size 79KB
          • SHA256 3b5d020eedfd971049e76d09af1582b0408f80c9e2b6ebfef8bc3bf61663efae
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          AcroFnt19.lst
          • Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\Cache\AcroFnt19.lst
          • Size 9KB
          • SHA256 d4741a0757152e35118d4447df50eebd38372b9922836bca5aad61cae7b11d65
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Network Persistent State
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
          • Size 191B
          • SHA256 decd450b0f54871bcb66ff682034b703adaebe88bed8e1551ffee5583a19f703
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          the-real-index
          • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Shared Dictionary\cache\index-dir\the-real-index
          • Size 96B
          • SHA256 0a6024a841b784d394ac5ee8f8ddf145c63fe32be814fde90dac88842632ec1d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          computed_hashes.json
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json
          • Size 477B
          • SHA256 3324698e469fdf02fc1079b1412b3193bd0e820c1f2c39a2427d728fc99b6572
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          verified_contents.json
          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json
          • Size 1KB
          • SHA256 695bccde6596030c898adcc17762407de3e1351a7d05bbfdaeccfed87bd26efe
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          12_All_Video.wpl
          • Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00004371\12_All_Video.wpl
          • Size 1KB
          • SHA256 9e23230d14512e50d6f7834713715adbf27cb94ed70f2c96fc50675612f23c18
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          1887B7E8-1DF5-4183-BA37-ECF38FCEB7A0
          • Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\1887B7E8-1DF5-4183-BA37-ECF38FCEB7A0
          • Size 187KB
          • SHA256 30cb656b948956d8261e516b0def8a9074a977d6251b8790f296afc66baae977
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          9DED7FC7-0FF8-4024-B7E0-689950E56508
          • Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\9DED7FC7-0FF8-4024-B7E0-689950E56508
          • Size 187KB
          • SHA256 8bf6866efd4cedb41acd286f62ed32c62f434802c5160b8e02a762d0532995a3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mip_sdk.miplog
          • Path C:\Users\Admin\AppData\Local\Microsoft\Office\DLP\mip\logs\mip_sdk.miplog
          • Size 9KB
          • SHA256 0a9639623fce392986e05a7163dc3aaa44bdc0dbf12052166325aea2356c02c8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          squaretile.png
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\squaretile.png
          • Size 2KB
          • SHA256 874ce616ef5aa0eff004bae68269a12742588f7ed91b4693bcb4dabe6b693c5d
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          tinytile.png
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\tinytile.png
          • Size 1KB
          • SHA256 46b1f2159cc41c26847f37dfbe1b633bf42981d78d9afbab7dd961089cc061f4
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          squaretile.png
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\squaretile.png
          • Size 2KB
          • SHA256 ed94f0ebd31f28b7535aac243eaab086fd190f5a22e5542e7466a33faa8284d3
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          tinytile.png
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\tinytile.png
          • Size 1KB
          • SHA256 d9dcbeab0dd4cdd8a375ae3781f402abd4ffb3364060ac07c5549432b4df2a62
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          squaretile.png
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png
          • Size 1KB
          • SHA256 b96debbdd5d638369d5b811e74a132e0568c0c435111250a6b9467a1262b8bec
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          tinytile.png
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\tinytile.png
          • Size 1KB
          • SHA256 8c5c4fcd50b5dec8446be7dba6d54ebb7508ce2c0d1a45439e6c5a7fc0934336
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          squaretile.png
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\squaretile.png
          • Size 1KB
          • SHA256 07bfc00c495e22c30352b5e8e1a3d448eb88eefcf35b6236ae927e3d86c8bdb5
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          tinytile.png
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\tinytile.png
          • Size 1KB
          • SHA256 6934897020367128096bf1bcbc1a634b05a3b7393565da745be446531cfc570f
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          backgroundTaskHost.exe.log
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\Microsoft\CLR_v4.0\UsageLogs\backgroundTaskHost.exe.log
          • Size 1008B
          • SHA256 780a39be0d8920637aa2b088bec6e27b71dff9355f9483f6f2cf0254c552b20c
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          www.office[1].xml
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\Microsoft\Internet Explorer\DOMStore\FRJ05D6E\www.office[1].xml
          • Size 109B
          • SHA256 7fb393c603dc3055129b1b1612d6a607407e03b84045d6eeab3d32e0321b72eb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          roaming.lock
          • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\Settings\roaming.lock
          • Size 48B
          • SHA256 e0c7268910971ae0b07f739130e2f384b48f3fa28206057b370bf8370563f5d5
          • MD5 SHA1 SHA512
          Submit Download

          ransomNOTE.txt
          • Path C:\Users\Admin\AppData\Local\Temp\ransomNOTE.txt
          • Size 1KB
          • SHA256 994fb6392a9c8d89d9dae87826b37d40d5f0e86acc4d26e255a547387eb36358
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          data.safe.bin
          • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\pbplptu3.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\datareporting\glean\db\data.safe.bin
          • Size 1KB
          • SHA256 c2c3c6df1dcd16d99cf61f89ed1adcc8c68c4e480a4ee1b159c6e8b6f4cb11fb
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          adiwejdiowejdoiewdeowedopwedxcmkedtmpScript.bat
          • Path C:\Users\Admin\Downloads\adiwejdiowejdoiewdeowedopwedxcmkedtmpScript.bat
          • Size 5.3MB
          • SHA256 14a3fb3a4b574de080a528e2b73d286976a6c4ce2400b1f60ae64275f71ad7f5
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          diwejdiowejdoiewdeowedopwedxcmkedtmpScript.bat
          • Path C:\Users\Admin\Downloads\diwejdiowejdoiewdeowedopwedxcmkedtmpScript.bat
          • Size 2.2MB
          • SHA256 d9e2f27ad1c4285a9d71dc5295fcf2e2c194447f0e7456c74cc601202af7830f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download