GhostyLite[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
GhostyLite.exe
Size 2.8MB
Sample260908-mbktmaxsaw
SHA256 3808c542481eed1adece2da4b43019ee4e3fa31be9b49ce88ace441c65f014b0
MD5 c5c98f5da2cdd9175cc376978d202ebd
SHA1 c7d5180083e4876231a3bbbac68bdb3ada3cabb5
SHA512 e1311e65a96d5d60ef2f2bb55b88b86c0293f4c8de2d51b2e52e87673c8ec8deb964638ffbe8601d5b1fe79b2661aacfd934ae9fd79ce00393bcb11c1a2824ec
SSDEEP 49152:ilKOLVCGr/FMfZmC+uMCAKKVSC+uMh6nTTa:eVlrac7KKPchL
TLSH
T12AD5E145F2A701D8C5A78138872AA31BEB723045073257CF6BE51A567F27EE22B7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
GhostyLite.exe

File Explorer

GhostyLite.exe

.exe 2.8MB

GhostyLite.exe

IMPHASH 5c157f37129ada1314e1398dd5e4e171
SHA256 3808c542481eed1adece2da4b43019ee4e3fa31be9b49ce88ace441c65f014b0
MD5 c5c98f5da2cdd9175cc376978d202ebd
SHA1 c7d5180083e4876231a3bbbac68bdb3ada3cabb5
SHA512 e1311e65a96d5d60ef2f2bb55b88b86c0293f4c8de2d51b2e52e87673c8ec8deb964638ffbe8601d5b1fe79b2661aacfd934ae9fd79ce00393bcb11c1a2824ec
SSDEEP 49152:ilKOLVCGr/FMfZmC+uMCAKKVSC+uMh6nTTa:eVlrac7KKPchL
TLSH
T12AD5E145F2A701D8C5A78138872AA31BEB723045073257CF6BE51A567F27EE22B7E311
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

871652

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\0x043949.DESKTOP-B5O\source\repos\Panda style loader\GhostyBootstrapper3\build\x64\Release\bin\GhostyBootstrapper3.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_47

D3DCompile

kernel32

QueryPerformanceCounter GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock WriteFile GetEnvironmentVariableW GetTempPathW CreateFileW CloseHandle LoadLibraryW GetModuleHandleW GetTickCount CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapFree MapViewOfFile UnmapViewOfFile CreateFileMappingA MultiByteToWideChar AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetLocaleInfoA IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead CreateDirectoryW FindClose FindFirstFileW GetFileAttributesW GetFileAttributesExW AreFileApisANSI GetLastError GetFileInformationByHandleEx LocalFree FormatMessageA GetLocaleInfoEx FreeLibrary GetProcAddress QueryPerformanceFrequency TerminateProcess LoadLibraryA ReleaseSRWLockExclusive GetCurrentProcess

user32

GetKeyboardLayout SetCapture SetCursorPos ReleaseCapture GetForegroundWindow LoadCursorW GetCursorPos TrackMouseEvent GetWindowLongW DispatchMessageW DefWindowProcW PostMessageW GetWindowRect DestroyWindow SetWindowPos ClientToScreen GetCapture ScreenToClient GetMessageExtraInfo GetKeyState SetClipboardData GetClipboardData EmptyClipboard CloseClipboard OpenClipboard LoadImageW SetForegroundWindow UpdateWindow PostQuitMessage LoadIconW GetClientRect IsWindowUnicode TranslateMessage SetLayeredWindowAttributes MoveWindow PeekMessageW SetWindowLongA IsWindow ShowWindow RegisterClassExW SetWindowTextW UnregisterClassW SetWindowRgn CreateWindowExW SendMessageW GetSystemMetrics SetCursor

gdi32

CreateRoundRectRgn

shell32

ShellExecuteW

ole32

CoInitializeEx CoCreateInstance

dwmapi

DwmEnableBlurBehindWindow DwmSetWindowAttribute

msvcp140

?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Id_cnt@id@locale@std@@0HA ?id@?$numpunct@D@std@@2V0locale@2@A ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Incref@facet@locale@std@@UEAAXXZ ?_Gettrue@_Locinfo@std@@QEBAPEBDXZ ?_Getfalse@_Locinfo@std@@QEBAPEBDXZ ?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ?_Throw_Cpp_error@std@@YAXH@Z ?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Random_device@std@@YAIXZ ?_Syserror_map@std@@YAPEBDH@Z _Mtx_lock _Cnd_do_broadcast_at_thread_exit _Thrd_detach _Mtx_unlock ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ??7ios_base@std@@QEBA_NXZ ??Bios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Xbad_function_call@std@@YAXXZ

imm32

ImmSetCandidateWindow ImmReleaseContext ImmGetContext ImmSetCompositionWindow

wininet

InternetOpenUrlA HttpQueryInfoA InternetSetOptionA InternetCloseHandle InternetReadFile InternetOpenA

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate _CxxThrowException __std_exception_destroy __intrinsic_setjmp __std_exception_copy __current_exception_context __current_exception strstr __C_specific_handler memcmp __RTDynamicCast memchr memset memmove memcpy longjmp strrchr

api-ms-win-crt-stdio-l1-1-0

ftell __p__commode _set_fmode _get_stream_buffer_pointers _fseeki64 fsetpos fflush setvbuf fgetpos __acrt_iob_func fgetc ungetc fputc fclose fseek __stdio_common_vsscanf fread __stdio_common_vsprintf _wfopen fwrite __stdio_common_vfprintf

api-ms-win-crt-runtime-l1-1-0

exit _invoke_watson terminate abort _register_thread_local_exe_atexit_callback _c_exit _exit _initterm_e _initterm _get_wide_winmain_command_line _initialize_wide_environment _configure_wide_argv _set_app_type _seh_filter_exe _cexit _beginthreadex _crt_atexit _register_onexit_function _initialize_onexit_table

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strncmp strcmp strncpy

api-ms-win-crt-heap-l1-1-0

free _set_new_mode malloc calloc _callnewh

api-ms-win-crt-convert-l1-1-0

strtol

api-ms-win-crt-math-l1-1-0

roundf _ldsign cosf ceilf sinf _dsign _fdsign fmodf acosf _ldclass __setusermatherr _fdclass _dclass sqrtf

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale