Overview
overview
3Static
static
3GhosttyDalamud.dll
windows10-2004-x64
1GhosttyDalamud.dll
windows11-ltsc_2024-x64
1KamiToolKit.dll
windows10-2004-x64
1KamiToolKit.dll
windows11-ltsc_2024-x64
1ghostty_core.dll
windows10-2004-x64
1ghostty_core.dll
windows11-ltsc_2024-x64
1ghostty_loader.dll
windows10-2004-x64
1ghostty_loader.dll
windows11-ltsc_2024-x64
1lua/adopt.js
windows10-2004-x64
3lua/adopt.js
windows11-ltsc_2024-x64
3lua/agenthosts.js
windows10-2004-x64
3lua/agenthosts.js
windows11-ltsc_2024-x64
3lua/animation.bat
windows10-2004-x64
3lua/animation.bat
windows11-ltsc_2024-x64
3lua/ask.bat
windows10-2004-x64
3lua/ask.bat
windows11-ltsc_2024-x64
3lua/asklinks.bat
windows10-2004-x64
3lua/asklinks.bat
windows11-ltsc_2024-x64
3lua/askmd.bat
windows10-2004-x64
3lua/askmd.bat
windows11-ltsc_2024-x64
3lua/askview.bat
windows10-2004-x64
3lua/askview.bat
windows11-ltsc_2024-x64
3lua/desk.bat
windows10-2004-x64
3lua/desk.bat
windows11-ltsc_2024-x64
3lua/gallery.bat
windows10-2004-x64
3lua/gallery.bat
windows11-ltsc_2024-x64
3lua/init.js
windows10-2004-x64
3lua/init.js
windows11-ltsc_2024-x64
3lua/ipc.js
windows10-2004-x64
3lua/ipc.js
windows11-ltsc_2024-x64
3lua/json.bat
windows10-2004-x64
3lua/json.bat
windows11-ltsc_2024-x64
3General
- Target GhosttyDalamud-0.3.3.1.zip
- Size 2.0MB
- Sample261107-vbypgset7q
- SHA256 06d3073ef117b6cab084134bf9f35592d763b465b2ba815d6058e6dd2a8e34d6
- MD5 0fd266f30679ddccdb06b1999d0332b2
- SHA1 cb4e0ae070665852cf5e1cafb79ff0de0a6a0ea0
- SHA512 fb7cb1a57084338cd0ff2213800f88dd586447b7d8d55befd69043eee47a1f005cf54057f18666597420211b619bf3e531a2aa95d35d411ac125628f2cd8b5a1
- SSDEEP 49152:MVegYFTQYv7UOIW5E2GTWEDLkWbQEhBEUhUu4ncGzZg3AOUIDTLmy:MOVtv7UX2GTPXkEQEcUSu4c6gwdIvL5
- TLSH T1AFA5335E588C6960DF7AA0EFF8F16F928B68535006C4A177F5CEF99098170D62C092BF
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
Behavioral task
behavioral1
Sample
GhosttyDalamud.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral2
Sample
GhosttyDalamud.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral3
Sample
KamiToolKit.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral4
Sample
KamiToolKit.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral5
Sample
ghostty_core.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral6
Sample
ghostty_core.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral7
Sample
ghostty_loader.dll
Resource
win10v2004-20260911-en
Behavioral task
behavioral8
Sample
ghostty_loader.dll
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral9
Sample
lua/adopt.js
Resource
win10v2004-20260911-en
Behavioral task
behavioral10
Sample
lua/adopt.js
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral11
Sample
lua/agenthosts.js
Resource
win10v2004-20260911-en
Behavioral task
behavioral12
Sample
lua/agenthosts.js
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral13
Sample
lua/animation.bat
Resource
win10v2004-20260911-en
Behavioral task
behavioral14
Sample
lua/animation.bat
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral15
Sample
lua/ask.bat
Resource
win10v2004-20260911-en
Behavioral task
behavioral16
Sample
lua/ask.bat
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral17
Sample
lua/asklinks.bat
Resource
win10v2004-20260911-en
Behavioral task
behavioral18
Sample
lua/asklinks.bat
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral19
Sample
lua/askmd.bat
Resource
win10v2004-20260911-en
Behavioral task
behavioral20
Sample
lua/askmd.bat
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral21
Sample
lua/askview.bat
Resource
win10v2004-20260911-en
Behavioral task
behavioral22
Sample
lua/askview.bat
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral23
Sample
lua/desk.bat
Resource
win10v2004-20260911-en
Behavioral task
behavioral24
Sample
lua/desk.bat
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral25
Sample
lua/gallery.bat
Resource
win10v2004-20260911-en
Behavioral task
behavioral26
Sample
lua/gallery.bat
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral27
Sample
lua/init.js
Resource
win10v2004-20260911-en
Behavioral task
behavioral28
Sample
lua/init.js
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral29
Sample
lua/ipc.js
Resource
win10v2004-20260911-en
Behavioral task
behavioral30
Sample
lua/ipc.js
Resource
win11ltsc2024-20260911-en
Behavioral task
behavioral31
Sample
lua/json.bat
Resource
win10v2004-20260911-en
Behavioral task
behavioral32
Sample
lua/json.bat
Resource
win11ltsc2024-20260911-en
Malware Config
Targets
-
- Target GhosttyDalamud.dll
- Size 76KB
- SHA256 8622d9a0f4d2581701fb242daad40cf60da38960d870263eb0688a384410e8ff
- MD5 bf3099daf0c367f894814636fa10884b
- SHA1 60da390aa7a04be79f2e3a3b5a8b1fac051b4da9
- SHA512 fcea18069089c99a52b549c894d4c98fcea7cd9292629098f4b9a809104642d2a84fb47a2106aefc272b265bb52fe5a0306bff8d494a9da8c3854b0e7c9ac52b
- SSDEEP 768:8ueqnuQ9m9YBvIr/7FzsL0Cx8tt+aInYzFEPdHKyDNoy10dzwGjzbvkiHUGToOl:jHw9YQDFzaIoaIk6idtb5ToOjVT2nn
- TLSH T164736D9173F89BBAE6EF96BAA07042511372C317E427DF861C88B4EE0D533D196413DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target KamiToolKit.dll
- Size 530KB
- SHA256 efaa77dfd5278a0b8a124a372c372a4ac2d35e22b46dd81cf96d886ec28cf3bb
- MD5 e5c73f72149afb416174b71ebb446563
- SHA1 f63d7f77ec136be1902f6fc260ee624755fd0af5
- SHA512 b2cd5becc21233e0f1c6528150020bfc10809998767aa74e6b5672a2e38063d6df0b2d9c0558f55fe4e6d48efe1e6260244820c7a88c7db22a1f99c4f68edf19
- SSDEEP 12288:RDNsZCe87IjRV+Vz3jA+4koCI9/0Hpp7DTIzzQFL:R5UyxroCcapRIzzo
- TLSH T1EFB44AA21368C766E69F1337D4B8113697F68291AB66F7CC6ACDAFC905C7B4186003D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target ghostty_core.dll
- Size 3.4MB
- SHA256 d10cff998a395a8b3b2dda0dc205f03cabfd56baf786dfa84e1e5e15310b3ba7
- MD5 ee3f252a3dd2b0a0e6ba844a90c497ce
- SHA1 6926d23cc251b8368910241574556495b8e21ce8
- SHA512 6c4ed53a9e848d798b1720765b1506867efcb6c985d164b4a26a9773e698b2048599c91ac202e4bd40398404b8159d360e13a1be03485bebafbe5b2f5a667ed1
- SSDEEP 98304:rInjvjcygfQE41mi6t++F/pwfpLOzA5QVfHF:Aal
- TLSH T16EF57D9BB4E7705CC02BD07D430F53235A6678895B202DBB62D9AA302EA17EC1B15FDD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target ghostty_loader.dll
- Size 245KB
- SHA256 c18e736a6287a3636f597dca1ad1f5b77169ce4bd1d92b007c5b74c1a396d9f8
- MD5 bdfcb4b7fb6cfff908ce39506c2f1ad1
- SHA1 60bf7fe75ce20a9f86d10b51017c9c115da9af2e
- SHA512 169fcd198fafce074c30df49f8de7fa0426de326763e834cac6cf435229a8da470ec79ef4cfe04f4e3764594394052a2bdd8f96a1ccecc30aa11e7e46b092344
- SSDEEP 6144:pKtWTw+VKEsnIisUR8iKMNL0vFLZaT1NIU5CcMMGZrwXfXDBNEt/dgj+hmO1Qb:pKtWc+VK/0iPGSG28b1O
- TLSH T181348E0B78E26EACC42380FD820B7925593A78481330C9F717D66E6D2D76DF24B77A25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score1/10 -
- Target lua/adopt.lua
- Size 10KB
- SHA256 93fe66cfa605ee012c8632d44134e99f7e0345e33ce477cb3301c56897b7178b
- MD5 d435cbeda74fd55539fb333bc27f1e3e
- SHA1 1b61307313a06ac730f080ba5dee6fd22b8dc48a
- SHA512 cc50766d0cadba20aa33c73adfc6388ddfcb9701629c725c12ef73f5a530a4335e9bc0fed7484258e387b10a76d4d1fd870d88c171f62e663a599cb7863cc18f
- SSDEEP 192:4sqqm7rmJvw0/XSvnuD+b3zHkf0AKVclhBNrkHKlnOP5T5g5APPoCsRlPj2XF:K6Sw+/Ha0AK+zBNCP5T5g5AHEXQF
- TLSH T1383274AB6A8113B19223D1761B0F7660FA3678B111356424A6DE909033F276FE1FBA94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target lua/agenthosts.lua
- Size 8KB
- SHA256 a02142beb38331d6401037d943d354afc2f5b4a64a0e3f9ac9f04c2a24b42248
- MD5 27908f3596145905cfabd48f77608806
- SHA1 fff979799c421c033013071b30a7367d578b75b1
- SHA512 2808dd8a7a58691f222c33a437bc97e33ff0947af26eb38070d4108ae72adf218060780e9bf1349cf1d5a1c73a910fff9665318b6bb3f282eff4cf6187ff9684
- SSDEEP 192:TIXLQ4abRr6n86usT5cLgWeJ/EvoF5aFN5VjRH0xNLpOjNGjHdb07Eht6zF3KX9s:kbqbRr6n86pcLgWsri/T1H0zIj4j67E6
- TLSH T12012624FB293FA7043616BA0D4478824BF44AE7261191C99E1DC82D4BB93F5DD1B2B3D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target lua/animation.lua
- Size 19KB
- SHA256 9815cda21749693da0c0a1104daddbf7394891c7b0c38e8ddd515afe18120c8c
- MD5 1245ad0c63ef48b49b3cf3235e8701c6
- SHA1 84bb508c94da54e49276af7d4f5becbea06108eb
- SHA512 f589f45761f4fd0d98b823b29c79010e2e5fe093a5fb790e331bae99ab8eb2d93f291080a8a2fc585a808db0d24333e27e79b1e785480e0bf3644c65fc0649f1
- SSDEEP 384:/OiESa3sUeQXdD/yrAv2f+VLOlr3YXijquGGQH:o8ojv/VSrYSjquIH
- TLSH T17192A46B79A02774625B91F2898B5142FF39A461031829B5F4CCC4883F6973CC2FBDE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target lua/ask.lua
- Size 30KB
- SHA256 97c5b41a67b877f2fea63208a22d93a92c4680fbdf1d20a6bdfc8b7b06c0e1bf
- MD5 05ff435b4a10c91cd50b39a6536ff37b
- SHA1 bd27c30d8ca7102563ac35dbd7ef8e4bdfcce760
- SHA512 e58336e70986bf44348d0900bf58e25e95a30f8ea467a2b799829a1c4a810c0769429f4d0200c8779b55aa57ea0c5948f4f5d687310f558ec0cc7e0732c3541a
- SSDEEP 768:2oVSVsr2WnKOb75QmhUOc1s+QkOyDFjTEV37PtSgDGRs0ZIie+cYpyg99x7m:2R6txPo+i2
- TLSH T13AE2A40FBE9A67B18292D471C8875101EBA76433224555A1F5DC80E03B55B2EE3FEF78
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target lua/asklinks.lua
- Size 20KB
- SHA256 dbb9c55295fb20b9cb1236241d4d186602a3563dad37af89d23d5690e651b807
- MD5 cd1955c91ec9a726b34911bc70cd941f
- SHA1 adc9fe4e2f2fc9b7ee167ed4850e71560aa9e8c9
- SHA512 252523db6a4e1d0f3a5dab602000ca7235c8ce94cd298b2ac5d8de696f477b6e146d2dd514e13e1e6841f6a3c93192c9bb4c506c3e5ce40a69e48e9edaa7830c
- SSDEEP 384:9yFV4ieVd34WhXX9Yu9/Z1FTCNbhrWdf80/yh4W2nQ7uTdhArouyBQCP:tdDBX9YulZGbhrWdfq2nQ7Q7AroVL
- TLSH T1F4A2745F7E8952719323D576854BA500FB25A4332346A578B1DC40E03FA236FA3FDB98
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target lua/askmd.lua
- Size 14KB
- SHA256 3cd60bcf1ad75e37676169b42732560eb359061d4d9af8be64a8ff62b0c61a83
- MD5 4ad21d745ce8f45da93c565bbb969e5b
- SHA1 20159a9a617b65e4f76c61806798fd5852a6ea08
- SHA512 a3b831d308aed34848fac21e46b27456e410518ee782e4aff8df7eb48fdb7a6e75ef32b066b7f185a8b6c3a0bb2396cb56fcb37d4a078e3540be2f1be2856a60
- SSDEEP 384:ze0RZrl4Fnri6c60BlSqqSh/6g6X6LkjmbUx4mL/9PVAGQW23:S0RZrlQna4UJk6Lk62JVABW23
- TLSH T13262412EBEA116B243A3C36ED9975805FA56683322440565F5DC41E06F0233EE3FEBB5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target lua/askview.lua
- Size 22KB
- SHA256 2374c6622279189fc4fa82da90ac1ec401b78e22696bdc6d5cf98bbe0bad90c6
- MD5 50ce82638092fbfe3f18eb92da280186
- SHA1 a833a79725326bedf0f5b33cdebb8365fa16f431
- SHA512 637c8411f18e9b778b2296720cb13b65c8438389914c27453cf60f8c8b6eb75b48b60a4700f313af48031a789e5f8276c0f4032b83b2b686e5b8efa7d820559f
- SSDEEP 384:kCH4q69mjHtLq8Tnsga4HTmJ0VvjFrl/ANGPeVUvVOoa:74h9mjHtLq8Yga4HTm+Rl/ANHyvo
- TLSH T16AA2240E6E4626749703D3A6D9075D06F71E60231B4B581A7AFE05902FB0ABDA2FDF70
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target lua/desk.lua
- Size 10KB
- SHA256 f279c1bb9e45239038c277731c0ffb42b8f34785f3675408d877262dc60d7349
- MD5 783553e63123756bd90a41d2e1b537a5
- SHA1 05911700d0d1cd336ce0a6a31b592be974dfefa7
- SHA512 47b168594a2a42c8d199569e1cba3630ec7cf013521b7112df85b73ad27901a69fa035636bbb36187ba7a385ae0ca0ef2900680173e67c0c18f3d6abd42b0e07
- SSDEEP 192:L9MT1FnpcnOiZIC9v1cfEUCKVeCanGquoJZsISYFD1Mk+jmdi8aUVG7L61s5D9DW:aBF+dZ/WsnienGquoJXbF6sdXVG7ks5Y
- TLSH T14E22D54B72E32374636582325E1B6458EF389421432518EBB1DCE0983FA6A2DD1F7EF5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target lua/gallery.lua
- Size 23KB
- SHA256 33abb4ca5cb4bbf70b94d6220f103537159487929b7e5f0c57dc419d6a5eb806
- MD5 7bc09649868f37d77908eb21acc98086
- SHA1 379875fb2c2ebfc710c906e84643e07d943ac458
- SHA512 aac16955817b1b12b8c694c93356ff3ea1b4d85998f6826a5fe9c82b0f7269c26e73ea45287fa3d8be60d52d8ada96b7fb349fba0412b7974281a0a1a08b00f4
- SSDEEP 384:WravpFnLqM2BG+BkvyivKp8Q1k80ndboQylmSL6pmOw7StpCR4m98kuqh:WrmpFnLqM2BG+BdivKpD1kzndboQylm6
- TLSH T1D4B2C69FBE8656740761CA62E80F9A34FBA4F435015A2665F0DC40E03B4177E93BFB98
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target lua/init.lua
- Size 9KB
- SHA256 1bfbdd18cbe7dc8b5683d7e41b6b135c2a814ea0846049a993b6ed5446ecbce1
- MD5 de5423e4512efa25349ccd4498ac44d6
- SHA1 9f39735f997b4e9577d375c604a617d0852f1f90
- SHA512 46cee36c0935c13466c87d51fa5b3747fdb6071e3967bfe562db23d99e2be072c5fbd19abc2a426c6b0a4fd0d05c0846e4b40edd7133e92154ce806c62208c9f
- SSDEEP 192:8bVsSs1l2wxrJUOmJtO+N1SFOZztk+BfxoEK5ruMSpj:8bVxsz24ufoc/NarZSpj
- TLSH T15222A66B12F6A37612221173F29B23117732C57A25323821B8ED90D863DE79F81F36E1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target lua/ipc.lua
- Size 20KB
- SHA256 390d9967954c131e9c73ad21f66a55305c1c16daf3274726b84e95ae5cabef11
- MD5 da5aa82cff21b124749f33b40bed2482
- SHA1 2c7545d247acbbdefb15774adbb8b75712b51496
- SHA512 48d5cffe69a2d291f140311fec2d23b41a37ef07839f3af76cf11fe34c8daa6085a4f3aaa016bcbe0ec66491f3432929d591bf7dc284bb23dd5218b78b422e1c
- SSDEEP 384:N0Fw13a2BeqTM6BfCfm6+tna3+u4prHXmR+WoW3Em/MbTU+C+MndcMG2TOpGfA/w:Nh3a2BeqTM65YAtna3+u4prHWR+E0mkm
- TLSH T1EEA2858F7583B3B84295A350AD4B5618FF09F931515A09A0E6EC80E0375171FE2B9FE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10 -
- Target lua/json.lua
- Size 9KB
- SHA256 0848c3f4e86fde55c715d392455bfc45c973447d600e7f67fa7a28fdb5f6b8fb
- MD5 4582da13cbcd8b9b00031818c00ae1c7
- SHA1 a0761a0b8e49895715630729a21a0404d74c29ab
- SHA512 9a82e2d1e601968c0278bfc07f9cc117e46e4fce2ec3759424ae56e6c86e56ee3fc831cddc8ce0b34a351a5f00315a80566bf7e94f8525ad04bf07714cd7bf77
- SSDEEP 192:4Z7X19X660r1JooilxbZ33r52fTCzjlvrH/D7ueVLvIcs3ObehoTU2jRGXgyxrcL:03q6WkjxsIhKe/TUGM7xo
- TLSH T1F712314EBD81627002ABC265489B4409FB58B433105569A9749E41F07FC26BEE3FEFF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score3/10