Ghost420-GUI[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Ghost420-GUI.exe
Size 11.5MB
Sample261011-e9fnkady6n
SHA256 1ab85281a80dd02de04af092ee72dbcf43d0d9e5a8a543e05f41efb9acdb3639
MD5 497bb5ed58f1487a74ddc31a0fee53d9
SHA1 d1abd3734774120a48df009d0fd0c16d0c763747
SHA512 ac7e9171116a82ff54a148f8f49391171739aeea0e52e2c0ce1b7d39a76ee7935cd2b67a78133094af0c8ade5f340684e0111750cecc9d46935b5c2c73c454a7
SSDEEP 98304:15uDTGQmdCzu6BxXtZLuDSwqgQ+1YiKeErCVMyVamShnaa6kh6DLLQu7gL6eqDWZ:KGEBxdZi+wo6pZkhs/QukLD
TLSH
T1A5C62A05BA6F98ACD596C87083574A735E2170DF0A36B9BF408442383FAEBF45B39359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Ghost420-GUI.exe

File Explorer

Ghost420-GUI.exe

.exe 11.5MB

Ghost420-GUI.exe

IMPHASH cdd038a4dc93da2f23fce95480722f3e
SHA256 1ab85281a80dd02de04af092ee72dbcf43d0d9e5a8a543e05f41efb9acdb3639
MD5 497bb5ed58f1487a74ddc31a0fee53d9
SHA1 d1abd3734774120a48df009d0fd0c16d0c763747
SHA512 ac7e9171116a82ff54a148f8f49391171739aeea0e52e2c0ce1b7d39a76ee7935cd2b67a78133094af0c8ade5f340684e0111750cecc9d46935b5c2c73c454a7
SSDEEP 98304:15uDTGQmdCzu6BxXtZLuDSwqgQ+1YiKeErCVMyVamShnaa6kh6DLLQu7gL6eqDWZ:KGEBxdZi+wo6pZkhs/QukLD
TLSH
T1A5C62A05BA6F98ACD596C87083574A735E2170DF0A36B9BF408442383FAEBF45B39359
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8276604

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Ghost420_GUI.pdb

bcryptprimitives

ProcessPrng

ntdll

RtlGetVersion NtWriteFile RtlNtStatusToDosError NtOpenFile NtCreateNamedPipeFile NtReadFile

kernel32

GetExitCodeProcess TerminateProcess LoadLibraryA SetFileInformationByHandle SetFileAttributesW UnhandledExceptionFilter GetFileAttributesW QueryFullProcessImageNameW OpenProcess GetUserDefaultUILanguage LCIDToLocaleName MoveFileExW FindClose GetCurrentProcess FlushFileBuffers GetCurrentProcessId lstrlenW SetUnhandledExceptionFilter InitializeSListHead GetSystemFirmwareTable GetFileInformationByHandleEx GetFullPathNameW GetFileType GetSystemTimePreciseAsFileTime HeapReAlloc GetDiskFreeSpaceExW DeleteCriticalSection SetLastError TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection RaiseException AreFileApisANSI HeapCreate SwitchToThread WriteFile TlsFree GetDiskFreeSpaceW TlsSetValue LockFile TlsGetValue SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx CreateMutexW UnmapViewOfFile HeapValidate HeapSize GetTempPathA GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW FlushViewOfFile CreateFileA TlsAlloc EncodePointer DeleteFileA HeapCompact RtlPcToFileHeader LoadLibraryW RtlLookupFunctionEntry WaitForSingleObjectEx WideCharToMultiByte IsDebuggerPresent MultiByteToWideChar HeapAlloc GetCurrentThread SleepEx FormatMessageW SetFileTime FindFirstFileExW GetFileInformationByHandle ExitProcess CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW GetModuleFileNameW DuplicateHandle WaitForMultipleObjects GetTempPathW RemoveDirectoryW DeleteFileW GetFinalPathNameByHandleW CopyFileExW SetWaitableTimer FindNextFileW UnlockFile LocalFree LockFileEx GetFileSize GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile GetTickCount GetCommandLineW InitializeCriticalSectionAndSpinCount CreateWaitableTimerExW CreateProcessW FreeEnvironmentStringsW GetEnvironmentStringsW ReadFile GetOverlappedResult SetThreadStackGuarantee CancelIo CreateEventW CreateDirectoryW CreateFileW QueryPerformanceFrequency IsProcessorFeaturePresent ReadFileEx SleepConditionVariableSRW WakeAllConditionVariable GetSystemInfo WriteFileEx GetEnvironmentVariableW CreateMutexA GetCurrentDirectoryW RtlVirtualUnwind LoadLibraryExA RtlCaptureContext DeviceIoControl SetEnvironmentVariableW OutputDebugStringA OutputDebugStringW LoadLibraryExW FreeLibrary WaitForSingleObject ProcessIdToSessionId Process32NextW HeapFree Process32FirstW CreateToolhelp32Snapshot AcquireSRWLockExclusive ReleaseSRWLockExclusive GetModuleHandleW HeapDestroy GetStdHandle GetConsoleMode GetConsoleOutputCP WriteConsoleW GetTimeZoneInformationForYear SystemTimeToFileTime GetProcessHeap RtlUnwindEx GetModuleHandleA Sleep GetProcAddress GetLastError CloseHandle GetCurrentThreadId ReleaseMutex CreateThread AddVectoredExceptionHandler QueryPerformanceCounter

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

shell32

SHAppBarMessage DragFinish ShellExecuteExW DragQueryFileW ShellExecuteW SHGetKnownFolderPath ILFree ILCreateFromPathW SHOpenFolderAndSelectItems

ole32

CoTaskMemFree CoInitialize CoInitializeEx CoCreateFreeThreadedMarshaler RevokeDragDrop CoTaskMemAlloc CoUninitialize RegisterDragDrop CoCreateInstance OleInitialize

advapi32

RegEnumKeyExW RegDeleteValueW RegQueryValueExW RegCloseKey RegOpenKeyExW RegGetValueW RegDeleteTreeW RegSetValueExW EventSetInformation GetTokenInformation RegCreateKeyExW EventUnregister EventWriteTransfer OpenProcessToken EventRegister SystemFunction036

user32

GetAsyncKeyState GetKeyboardState RegisterWindowMessageA IsProcessDPIAware TrackPopupMenu DrawTextW GetWindowDC OffsetRect MapWindowPoints GetMenuBarInfo ShowWindow PostQuitMessage SystemParametersInfoA CreatePopupMenu CreateMenu CreateIcon RemoveMenu AppendMenuW InsertMenuW CheckMenuItem DrawIconEx ReleaseDC GetDC EnableMenuItem VkKeyScanW SetMenuItemInfoW CreateAcceleratorTableW DestroyAcceleratorTable DestroyIcon DestroyMenu GetKeyState MapVirtualKeyExW GetKeyboardLayout ToUnicodeEx GetWindowTextLengthW GetWindowTextW GetSystemMenu TranslateAcceleratorW GetUpdateRect ValidateRect GetRawInputData SetWindowLongW SetMenu GetMenuItemInfoW ShowCursor EnumChildWindows DispatchMessageA GetMessageA GetClipCursor AdjustWindowRect MsgWaitForMultipleObjectsEx GetMessageW GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW PostThreadMessageW DispatchMessageW TranslateMessage PeekMessageW SetCursor ClipCursor CloseTouchInputHandle GetTouchInputInfo DestroyWindow TrackMouseEvent SetCapture SystemParametersInfoW ReleaseCapture FillRect GetMonitorInfoW MonitorFromRect GetWindowLongW ScreenToClient GetMenu DefWindowProcW SetWindowLongPtrW SetPropW LoadCursorW SetWindowDisplayAffinity RegisterTouchWindow GetSystemMetrics IsWindow CreateWindowExW AdjustWindowRectEx RegisterClassExW SetCursorPos InvalidateRgn SetWindowPos GetWindowRect UpdateWindow InvalidateRect FindWindowExW GetParent SendInput MapVirtualKeyW SetForegroundWindow GetForegroundWindow GetClientRect FlashWindowEx GetActiveWindow ClientToScreen IsWindowEnabled MonitorFromPoint GetWindowLongPtrW EnumDisplayMonitors MonitorFromWindow IsIconic IsWindowVisible EnableWindow RegisterRawInputDevices RedrawWindow GetCursorPos SendMessageW PostMessageW SetWindowRgn GetWindow SetFocus SetParent DrawMenuBar SetWindowTextW

oleaut32

GetErrorInfo SysFreeString SysStringLen SetErrorInfo

gdi32

BitBlt CombineRgn CreateRectRgn CreateSolidBrush GetDeviceCaps CreateCompatibleDC SetTextColor SetBkMode DeleteDC SelectObject CreateDIBSection DeleteObject

dwmapi

DwmSetWindowAttribute DwmGetWindowAttribute DwmEnableBlurBehindWindow

comctl32

DefSubclassProc SetWindowSubclass TaskDialogIndirect RemoveWindowSubclass

shlwapi

SHCreateMemStream

bcrypt

BCryptGenRandom

iphlpapi

GetAdaptersAddresses

api-ms-win-crt-string-l1-1-0

wcslen strlen wcsncmp _wcsicmp strcpy_s strcspn wcscmp strncmp strcmp strspn

api-ms-win-crt-math-l1-1-0

roundf round trunc pow __setusermatherr log floor

api-ms-win-crt-convert-l1-1-0

_wtoi _ultow_s wcstol

api-ms-win-crt-heap-l1-1-0

realloc calloc malloc _msize _callnewh free _set_new_mode

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_endthreadex _c_exit _cexit _seh_filter_exe _set_app_type _register_onexit_function _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit _exit _crt_atexit __p___argc terminate __p___argv abort _initialize_onexit_table _beginthreadex _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale