Ghosts_Toruney_Cleaner[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Ghosts_Toruney_Cleaner.exe
Size 135KB
Sample261024-q3jmesvtbz
SHA256 d5b857f4972fea91c9d476905d4fb6f80de89df311da0dce83adfbef4d32d1b3
MD5 03c9069653a814dd3a0d69d1431145eb
SHA1 d57ca643bfb63dc9df696054ff12770132a81038
SHA512 b7958fa0c0d2953ed4062f2e241f982377b4b0f990a179da9bf328a39e0a00b79ee76a537cd42482d2d782e33e36f390c85585d88fe16b882e67c4c9edd366cf
SSDEEP 768:EcLW2SN3ItwfkDG7FIMXVGBzn5v1QLKeJunPxrU+lP/X3Zwkin9Sbh9Sb:LLWDN4qfkDo8z5tMGP9U+BBBuC
TLSH
T17ED3E8439ADC3CC6C038A3B477BB93C5C72EEC9592A2C28F56C01295D9BE55379227D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Ghosts_Toruney_Cleaner.exe

File Explorer

Ghosts_Toruney_Cleaner.exe

.exe 135KB

Ghosts_Toruney_Cleaner.exe

IMPHASH 159731ee3c8c9d0496dcd3dc6dfc52a1
SHA256 d5b857f4972fea91c9d476905d4fb6f80de89df311da0dce83adfbef4d32d1b3
MD5 03c9069653a814dd3a0d69d1431145eb
SHA1 d57ca643bfb63dc9df696054ff12770132a81038
SHA512 b7958fa0c0d2953ed4062f2e241f982377b4b0f990a179da9bf328a39e0a00b79ee76a537cd42482d2d782e33e36f390c85585d88fe16b882e67c4c9edd366cf
SSDEEP 768:EcLW2SN3ItwfkDG7FIMXVGBzn5v1QLKeJunPxrU+lP/X3Zwkin9Sbh9Sb:LLWDN4qfkDo8z5tMGP9U+BBBuC
TLSH
T17ED3E8439ADC3CC6C038A3B477BB93C5C72EEC9592A2C28F56C01295D9BE55379227D8
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

24272

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\User\source\repos\cleaner\cleaner\x64\Release\cleaner.pdb

kernel32

FindFirstFileW GetStdHandle SetConsoleTextAttribute FindClose CreateFileW GetLocaleInfoEx FormatMessageA LocalFree FindNextFileW GetFileAttributesExW SetFileInformationByHandle AreFileApisANSI CloseHandle GetLastError GetModuleHandleW GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId FindFirstFileExW

advapi32

GetUserNameW

msvcp140

?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xout_of_range@std@@YAXPEBD@Z ?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Winerror_map@std@@YAHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?good@ios_base@std@@QEBA_NXZ ?_Syserror_map@std@@YAPEBDH@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove memcpy __std_exception_destroy __std_exception_copy __std_terminate __C_specific_handler _CxxThrowException __current_exception __current_exception_context memset

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode malloc free

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _c_exit __p___argv __p___argc terminate _crt_atexit _cexit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _set_app_type _seh_filter_exe _initialize_onexit_table _register_onexit_function _exit abort _invalid_parameter_noinfo_noreturn system exit

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode