Ghost-Client[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Ghost-Client.exe
Size 661KB
Sample261030-paembsds2p
SHA256 4e454aca377c0524077b22141308c551dca6610de68d0ae7b24751ce4836520f
MD5 3ed1c7cff1bcc95c6a9159690422b82d
SHA1 bce6b1ba7158c622a6f94cdfe7bb1019292b2e9b
SHA512 018dd9b44c229d52e1841b3482b9bc977ad7d21299a2dfd981dece0393f9447da3721422b590f3b1f3bf32d6ece7438cd4456feba67899ac3f63c3468fbd6e1d
SSDEEP 12288:4eydXuRzHKECDADRDfeVPtkyUA5YiQns2N/S8u4:4e2X4HKdDoY0yqiQnTN/i4
TLSH
T1E3E48E42F2A580ECC02A91398956E61FEB363C54072056CB73D07B991FB76E16FB7712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Ghost-Client.exe

File Explorer

Ghost-Client.exe

.exe 661KB

Ghost-Client.exe

IMPHASH 6094218aea37925d3c459dbc321be9e2
SHA256 4e454aca377c0524077b22141308c551dca6610de68d0ae7b24751ce4836520f
MD5 3ed1c7cff1bcc95c6a9159690422b82d
SHA1 bce6b1ba7158c622a6f94cdfe7bb1019292b2e9b
SHA512 018dd9b44c229d52e1841b3482b9bc977ad7d21299a2dfd981dece0393f9447da3721422b590f3b1f3bf32d6ece7438cd4456feba67899ac3f63c3468fbd6e1d
SSDEEP 12288:4eydXuRzHKECDADRDfeVPtkyUA5YiQns2N/S8u4:4e2X4HKdDoY0yqiQnTN/i4
TLSH
T1E3E48E42F2A580ECC02A91398956E61FEB363C54072056CB73D07B991FB76E16FB7712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

454128

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\pc\source\repos\Ghost-Client\x64\Release\Ghost-Client.pdb

kernel32

GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock SetLastError CreateToolhelp32Snapshot CloseHandle GetSystemInfo Module32FirstW VirtualProtectEx VirtualAllocEx GetModuleHandleW FlushInstructionCache Module32NextW VirtualFreeEx VirtualQueryEx Process32First Module32Next QueryPerformanceCounter Module32First OpenProcess Process32Next GetExitCodeProcess Sleep InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId SetUnhandledExceptionFilter WakeAllConditionVariable GetCurrentThreadId SleepConditionVariableSRW AcquireSRWLockExclusive ReleaseSRWLockExclusive OutputDebugStringA FreeLibrary GetModuleHandleA VerSetConditionMask GetProcAddress IsDBCSLeadByte QueryPerformanceFrequency LoadLibraryA MultiByteToWideChar GetLocaleInfoA GetProcessId

user32

DestroyWindow GetWindowRect DispatchMessageA MonitorFromPoint FindWindowA GetDpiForWindow GetWindowThreadProcessId GetClientRect CloseClipboard EmptyClipboard GetClipboardData SetClipboardData ShowWindow SetWindowLongA MessageBoxA EnumDisplaySettingsA DefWindowProcA CreateWindowExA SetLayeredWindowAttributes TranslateMessage PeekMessageA UnregisterClassA PostQuitMessage RegisterClassExA UpdateWindow GetAsyncKeyState mouse_event GetSystemMetrics SetWindowDisplayAffinity DefWindowProcW GetKeyState SetCursor SetCapture GetForegroundWindow GetKeyboardLayout TrackMouseEvent GetMessageExtraInfo LoadCursorA GetDC ScreenToClient ClientToScreen GetCapture IsWindowUnicode ReleaseCapture SetCursorPos ReleaseDC GetCursorPos OpenClipboard

gdi32

GetDeviceCaps

shell32

ShellExecuteW

msvcp140

_Thrd_detach _Cnd_do_broadcast_at_thread_exit _Mtx_unlock _Query_perf_counter _Mtx_lock ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency ?_Xbad_function_call@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z

d3dcompiler_47

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmSetCandidateWindow ImmSetCompositionWindow ImmGetContext ImmReleaseContext

d3d11

D3D11CreateDeviceAndSwapChain

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy memmove memset __current_exception __current_exception_context __C_specific_handler _CxxThrowException memchr memcmp __std_terminate __std_exception_destroy __std_exception_copy

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc

api-ms-win-crt-stdio-l1-1-0

fclose ftell __acrt_iob_func __stdio_common_vsprintf __p__commode fflush __stdio_common_vsscanf fread _wfopen fwrite __stdio_common_vfprintf fseek _set_fmode

api-ms-win-crt-math-l1-1-0

fmodf round sqrtf __setusermatherr cosf logf acosf floorf powf ceilf sinf

api-ms-win-crt-string-l1-1-0

strncmp strlen strncpy _stricmp _wcsicmp strcmp

api-ms-win-crt-time-l1-1-0

_time64 _localtime64_s

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _configure_narrow_argv _register_onexit_function _crt_atexit _seh_filter_exe _set_app_type terminate _get_initial_narrow_environment _initterm _initterm_e exit _exit _beginthreadex __p___argc __p___argv _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _cexit

api-ms-win-crt-locale-l1-1-0

_configthreadlocale