General
- Target Ghost_1_CLICK.zip
- Size 1.5MB
- Sample260901-2k8pdafb23
- SHA256 a1a8844215b8b8f3547f68960d753405613d28e58b5d1cbe406e6c268efd337c
Score
9/10
Malware Config
Targets
-
- Target CLEANNER LIMPATUDO.bat
- Size 384B
- SHA256 ba479a7bc09ed624983ad0a964869f656c94317defff7387c383367139d800ad
Score7/10-
Loads dropped DLL
-
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
-
- Target Ghost....exe
- Size 1.8MB
- SHA256 a7d54a0c6cf7e87b99119394cab5783993c27e2203788d12a1fa62e3b00b7144
Score9/10-
Looks for VirtualBox Guest Additions in registry
-
Looks for VMWare Tools registry key
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Maps connected drives based on registry
Disk information is often read in order to detect sandboxing environments.