Ghost_1_CLICK[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
Ghost_1_CLICK.zip
Size 1.5MB
Sample260901-2k8pdafb23
SHA256 a1a8844215b8b8f3547f68960d753405613d28e58b5d1cbe406e6c268efd337c
MD5 c23cb5a3542fc84924cca0ba63541439
SHA1 33b01a2b45c880c02de3dda5023a55a357fea94f
SHA512 a7a49dfb9885beb8d65273967ec537a364937367a4de58470ae77810e65c1b04f09bc3da8c4bc367d568db0601c263701db21f345ec9d8c484739477fa62eb37
SSDEEP 24576:6tw4ZCO0z7EbbpYX0yVMHLWsV/MFSM4Djgf30CeRoGkY6ifo:m3u7Ebb2xMHLt/B43HevFo
TLSH
T1CC65333CDE6AF6F2B9D5E2A89920C271E0247314EB93FD9D4BFA1105CB98C9743A4153
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

costura packer

Malware Config

Signatures

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
static1/unpack001/Ghost....exe	costura

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Ghost....exe

File Explorer

Ghost_1_CLICK.zip

.zip 1.5MB
AVISO.txt

201B
CLEANNER LIMPATUDO.bat

384B
Ghost....exe

.exe 1.8MB

Ghost_1_CLICK.zip

SHA256 a1a8844215b8b8f3547f68960d753405613d28e58b5d1cbe406e6c268efd337c
MD5 c23cb5a3542fc84924cca0ba63541439
SHA1 33b01a2b45c880c02de3dda5023a55a357fea94f
SHA512 a7a49dfb9885beb8d65273967ec537a364937367a4de58470ae77810e65c1b04f09bc3da8c4bc367d568db0601c263701db21f345ec9d8c484739477fa62eb37
SSDEEP 24576:6tw4ZCO0z7EbbpYX0yVMHLWsV/MFSM4Djgf30CeRoGkY6ifo:m3u7Ebb2xMHLt/B43HevFo
TLSH
T1CC65333CDE6AF6F2B9D5E2A89920C271E0247314EB93FD9D4BFA1105CB98C9743A4153
MD5 SHA1 SHA512 SSDEEP TLSH

Ghost....exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 a7d54a0c6cf7e87b99119394cab5783993c27e2203788d12a1fa62e3b00b7144
MD5 91ce2adcee43130b4700c8b4bfb940bf
SHA1 b6b31d712591bfe0770069b0911fa9b79904ee50
SHA512 67626ff5d3e9c275a3b7b4a3ae31ab928c6f5fa7cba2ccf6e7695ddb0e49f2cb8b9a1c265d0a6f57b190b7ed4c2774e3381a70ff07f2a0bd4fedaffa8614fdc1
SSDEEP 24576:OTM3jpP8OuNiiuwjda/iyBErdWgNFKLSE2DFY7lsseHIawBue7B:9NOcdrErdHFR4lTerwsC
TLSH
T17385CF1E33555D5AD037A3FD0060F3B852A50FD1BA12D34A58F0FD93FA86A468FA96C8
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Costura .NET executable packer

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1892362

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

64vY0d0

Size

155KB

Virtual Size

155KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

64vY0d0

Size

155KB

Virtual Size

155KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

269KB

Virtual Size

268KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

mpIaOXHg

Size

512B

Virtual Size

22B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.????

Size

512B

Virtual Size

276B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Ghost_1_CLICK.zip

AVISO.txt

CLEANNER LIMPATUDO.bat

Ghost....exe

mscoree

dotnet