Overview

overview

10

Static

static

3

GHOST FUD CRYPTER.exe

windows10-2004-x64

10

GHOST FUD CRYPTER.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    900s
  • max time network
    814s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/08/2026, 00:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    GHOST FUD CRYPTER.exe
  • Size 9.5MB
  • Sample260824-aefymabe93
  • SHA256 339a880408b453df07d35dba3979144b2cee3a778bc3906e52d1b72acaf5b045
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasionpersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Extracted

Path

  • C:\Users\Admin\AppData\Local\Temp\ransomNOTE.txt

Ransom Note
  • Hi! All your files are encrypted. -- If for some reason you read this text before the encryption ended, this can be understood by the fact that the computer slows down, and your heart rate has increased due to the ability to turn it off, then we recommend that you move away from the computer and accept that you have been compromised, rebooting/shutdown will cause you to lose files whitout the possibility of recovery and even god will not be able to help you, it could be files on the network belonging to other users, sure you want to take that responsibility? -- Our encryption algorithms are very strong and your files are very well protected, you can't hope to recover them whitout paying the ransom. The only way to get your files back is to follow the 4 steps below. As soon as the ransom will be paid, you will see the decryptor program on the Desktop folder. Do not try to recover your files whitout a decrypt program, you may damage them and then they will be impossible to recover. (If you dont know how to, just search it on YouTube, like How to download Exodus) 1.Download Exodus 2.Get some Bitcoin for 300$ (in USD) 3.Swap Bitcon to Monero 4.Send the Monero to this address: 4BKcz4x1tJg7Tqr2nKJ1Ug2totBBP54E9F8UkY79vK8nQaShnzFtPr872s6jGV3TRPMAGzrZdBG7UMa3XFar4fg49eHDw9W -- Oh, and if you decide you dont want to pay or take too much time, well all your files, and information we know about you WILL be transfered to the FBI. We are NOT joking, hurry up with the decision.

Signatures

  • Creates a file in the Startup directory 1 TTPs 1 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

    credential_accessstealer
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops desktop.ini file(s) 27 IoCs
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 2 IoCs
    defense_evasion
  • Suspicious use of WriteProcessMemory 7 IoCs
  • Views/modifies file attributes 1 TTPs 2 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\GHOST FUD CRYPTER.exe
    "C:\Users\Admin\AppData\Local\Temp\GHOST FUD CRYPTER.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3560
    • C:\Windows\system32\cmd.exe
      cmd /C "attrib +h C:\Users\Admin\Downloads\adiwejdiowejdoiewdeowedopwedxcmkedtmpScript.bat"
      2⤵
      • Hide Artifacts: Hidden Files and Directories
      • Suspicious use of WriteProcessMemory
      PID:5012
      • C:\Windows\system32\attrib.exe
        attrib +h C:\Users\Admin\Downloads\adiwejdiowejdoiewdeowedopwedxcmkedtmpScript.bat
        3⤵
        • Views/modifies file attributes
        PID:4676
    • C:\Users\Admin\Downloads\adiwejdiowejdoiewdeowedopwedxcmkedtmpScript.bat
      C:\Users\Admin\Downloads\adiwejdiowejdoiewdeowedopwedxcmkedtmpScript.bat
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1580
      • C:\Windows\system32\cmd.exe
        cmd /C "attrib +h C:\Users\Admin\Downloads\diwejdiowejdoiewdeowedopwedxcmkedtmpScript.bat"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:5664
        • C:\Windows\system32\attrib.exe
          attrib +h C:\Users\Admin\Downloads\diwejdiowejdoiewdeowedopwedxcmkedtmpScript.bat
          4⤵
          • Views/modifies file attributes
          PID:5904
      • C:\Users\Admin\Downloads\diwejdiowejdoiewdeowedopwedxcmkedtmpScript.bat
        C:\Users\Admin\Downloads\diwejdiowejdoiewdeowedopwedxcmkedtmpScript.bat
        3⤵
        • Creates a file in the Startup directory
        • Executes dropped EXE
        • Drops desktop.ini file(s)
        PID:4232
      • C:\Windows\system32\notepad.exe
        notepad ransomNOTE.txt
        3⤵
          PID:4424
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k GPSvcGroup
      1⤵
        PID:5792
      • C:\Windows\System32\SecurityHealthHost.exe
        \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
        1⤵
          PID:2548

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              ReaderMessages
              • Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
              • Size 64KB
              • SHA256 2d05723e13a66b8e94df3cb4f96b27a1e0a9f1ca50dbc71dc25249d6a2932c88
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              notificationsDB
              • Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\DesktopNotification\NotificationsDB\notificationsDB
              • Size 24KB
              • SHA256 cb94d8f17c476f5e7b5778eeafcd6b83e3c42ffeee51d3cce8c61e1850700b28
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              BrowserMetrics-6A50DA8A-155C.pma
              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-6A50DA8A-155C.pma
              • Size 832KB
              • SHA256 3fc97d69dc0ee3fea2232799eba3bef3907b063c84267d3806f53082803ee3f9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              the-real-index
              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
              • Size 96B
              • SHA256 9fe75f5c3af81c3aaab8df83fed8e86889243243e3847160f7ec826e3add42e6
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              messages.json
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_locales\af\messages.json
              • Size 972B
              • SHA256 f3e3f6a4dae9c41eebb4f294a34df5590912c01870a4bab0298177e56dbb714b
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              messages.json
              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.107.1_0\_locales\am\messages.json
              • Size 1KB
              • SHA256 f81334ea3981f88db995167c14504c8b21a284217ae56c6e8cdc08e3cc6cc67a
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              360DE1F3E174E84794C36651DD126686164A2F9A
              • Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\yt3t4i5l.default-release\cache2\entries\360DE1F3E174E84794C36651DD126686164A2F9A
              • Size 558KB
              • SHA256 c75b6bc160a5627ef1007564ed44f9fee0aed1cb3587bcf7ecf5d28372e0dfae
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ransomNOTE.txt
              • Path C:\Users\Admin\AppData\Local\Temp\ransomNOTE.txt
              • Size 1KB
              • SHA256 994fb6392a9c8d89d9dae87826b37d40d5f0e86acc4d26e255a547387eb36358
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              data.safe.bin
              • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\ifnlrd35.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\datareporting\glean\db\data.safe.bin
              • Size 1KB
              • SHA256 bccc9f3431576c53ab2a59b0bfad92401cd2c95f0eba74355e7557bf13aa29bd
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              adiwejdiowejdoiewdeowedopwedxcmkedtmpScript.bat
              • Path C:\Users\Admin\Downloads\adiwejdiowejdoiewdeowedopwedxcmkedtmpScript.bat
              • Size 5.3MB
              • SHA256 14a3fb3a4b574de080a528e2b73d286976a6c4ce2400b1f60ae64275f71ad7f5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              diwejdiowejdoiewdeowedopwedxcmkedtmpScript.bat
              • Path C:\Users\Admin\Downloads\diwejdiowejdoiewdeowedopwedxcmkedtmpScript.bat
              • Size 2.2MB
              • SHA256 d9e2f27ad1c4285a9d71dc5295fcf2e2c194447f0e7456c74cc601202af7830f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download