Technical Information
Malicious functions
Reads files which store third party applications passwords
- %HOMEPATH%\desktop\correct.avi
- %HOMEPATH%\desktop\cveuropeo.doc
- %HOMEPATH%\desktop\dialmap.bmp
- %HOMEPATH%\desktop\fi51.doc
- %HOMEPATH%\desktop\hadac_newsletter_july_2010_final.docx
- %HOMEPATH%\desktop\hanni_umami_chapter.doc
- %HOMEPATH%\desktop\holycrosschurchinstructions.docx
- %HOMEPATH%\desktop\issi2013_template_for_posters.docx
- %HOMEPATH%\desktop\lisp_success.doc
- %HOMEPATH%\desktop\sdszfo.docx
- %HOMEPATH%\desktop\split.avi
Modifies file system
Creates the following files
- C:\ghostcry.log
- %APPDATA%\telegram desktop\telegram.exe.ghostcry
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\user.js.ghostcry
- %APPDATA%\mozilla\firefox\profiles\v08trqk6.default-release\prefs.js.ghostcry
- %APPDATA%\mozilla\firefox\profiles\m15ucxjx.default\user.js.ghostcry
- %APPDATA%\microsoft\windows\start menu\programs\winrar\winrar.lnk.ghostcry
- %APPDATA%\microsoft\windows\start menu\programs\winrar\winrar help.lnk.ghostcry
- %APPDATA%\microsoft\windows\start menu\programs\winrar\what is new in the latest version.lnk.ghostcry
- %APPDATA%\microsoft\windows\start menu\programs\winrar\console rar manual.lnk.ghostcry
- %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\uninstall telegram.lnk.ghostcry
- %APPDATA%\microsoft\windows\start menu\programs\telegram desktop\telegram.lnk.ghostcry
- %APPDATA%\telegram desktop\updater.exe.ghostcry
- %APPDATA%\telegram desktop\unins000.exe.ghostcry
- %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\private character editor.lnk.ghostcry
- %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\internet explorer (no add-ons).lnk.ghostcry
- %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\control panel.lnk.ghostcry
- %APPDATA%\microsoft\windows\start menu\programs\accessories\system tools\computer.lnk.ghostcry
- %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\on-screen keyboard.lnk.ghostcry
- %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\narrator.lnk.ghostcry
- %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\magnify.lnk.ghostcry
- %APPDATA%\microsoft\windows\start menu\programs\accessories\accessibility\ease of access.lnk.ghostcry
- %APPDATA%\microsoft\windows\start menu\programs\accessories\windows explorer.lnk.ghostcry
- %APPDATA%\microsoft\windows\start menu\programs\accessories\run.lnk.ghostcry
- %APPDATA%\microsoft\windows\start menu\programs\maintenance\help.lnk.ghostcry
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_1024.db.ghostcry
- %APPDATA%\thunderbird\profiles\chdgbv82.default-release\prefs.js.ghostcry
- %HOMEPATH%\links\desktop.lnk.ghostcry
- %HOMEPATH%\favorites\windows live\windows live spaces.url.ghostcry
- %HOMEPATH%\favorites\windows live\windows live mail.url.ghostcry
- %HOMEPATH%\favorites\windows live\windows live gallery.url.ghostcry
- %HOMEPATH%\favorites\windows live\get windows live.url.ghostcry
- %HOMEPATH%\favorites\msn websites\msnbc news.url.ghostcry
- %HOMEPATH%\favorites\msn websites\msn.url.ghostcry
- %HOMEPATH%\favorites\msn websites\msn sports.url.ghostcry
- %HOMEPATH%\favorites\msn websites\msn money.url.ghostcry
- %HOMEPATH%\favorites\msn websites\msn entertainment.url.ghostcry
- %HOMEPATH%\favorites\msn websites\msn autos.url.ghostcry
- %HOMEPATH%\favorites\microsoft websites\microsoft store.url.ghostcry
- %HOMEPATH%\favorites\microsoft websites\microsoft at work.url.ghostcry
- %HOMEPATH%\favorites\microsoft websites\microsoft at home.url.ghostcry
- %HOMEPATH%\favorites\microsoft websites\ie site on microsoft.com.url.ghostcry
- %HOMEPATH%\favorites\microsoft websites\ie add-on site.url.ghostcry
- %HOMEPATH%\favorites\links for united states\usa.gov.url.ghostcry
- %HOMEPATH%\favorites\links for united states\gobiernousa.gov.url.ghostcry
- %HOMEPATH%\favorites\links\web slice gallery.url.ghostcry
- %HOMEPATH%\desktop\wrar520.exe.ghostcry
- %HOMEPATH%\desktop\telegram.lnk.ghostcry
- %HOMEPATH%\desktop\skypesetup.exe.ghostcry
- %HOMEPATH%\desktop\google chrome.lnk.ghostcry
- %APPDATA%\microsoft\windows\start menu\programs\accessories\notepad.lnk.ghostcry
- %APPDATA%\microsoft\windows\start menu\programs\google chrome\google chrome.lnk.ghostcry
- %APPDATA%\microsoft\windows\start menu\programs\accessories\command prompt.lnk.ghostcry
- %APPDATA%\microsoft\windows\start menu\programs\internet explorer.lnk.ghostcry
- %APPDATA%\microsoft\windows\start menu\programs\internet explorer (64-bit).lnk.ghostcry
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\visualelements\splash-620x300.png.ghostcry
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\16.png.ghostcry
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\128.png.ghostcry
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\128.png.ghostcry
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\apdfllckaahabafndbhieahigkjlhalf\6.2_0\128.png.ghostcry
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\main.js.ghostcry
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\main.html.ghostcry
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\icon_16.png.ghostcry
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\aohghmighlieiainnegkcijnfilokake\0.0.0.6_0\icon_128.png.ghostcry
- %LOCALAPPDATA%\google\chrome\user data\default\databases\databases.db.ghostcry
- %LOCALAPPDATA%\google\chrome\user data\default\google profile.ico.ghostcry
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\visualelements\smalllogo.png.ghostcry
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\48.png.ghostcry
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\visualelements\logo.png.ghostcry
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\installer\setup.exe.ghostcry
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\installer\chrome.7z.ghostcry
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\secondarytile.png.ghostcry
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\nacl64.exe.ghostcry
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\icudtl.dat.ghostcry
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\delegate_execute.exe.ghostcry
- %LOCALAPPDATA%\google\chrome\application\42.0.2311.135\42.0.2311.135.manifest.ghostcry
- %LOCALAPPDATA%\google\chrome\application\chrome.exe.ghostcry
- %LOCALAPPDATA%\iconcache.db.ghostcry
- %HOMEPATH%\links\downloads.lnk.ghostcry
- %HOMEPATH%\desktop\chromesetup.exe.ghostcry
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\128.png.ghostcry
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_32.db.ghostcry
- %LOCALAPPDATA%\google\chrome\user data\default\extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\32.png.ghostcry
- %APPDATA%\microsoft\windows\sendto\fax recipient.lnk.ghostcry
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows media player.lnk.ghostcry
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\windows explorer.lnk.ghostcry
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\opera.lnk.ghostcry
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\internet explorer.lnk.ghostcry
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\google chrome.lnk.ghostcry
- %APPDATA%\microsoft\internet explorer\quick launch\user pinned\taskbar\firefox.lnk.ghostcry
- %APPDATA%\microsoft\internet explorer\quick launch\window switcher.lnk.ghostcry
- %APPDATA%\microsoft\internet explorer\quick launch\shows desktop.lnk.ghostcry
- %APPDATA%\microsoft\internet explorer\quick launch\launch internet explorer browser.lnk.ghostcry
- %APPDATA%\microsoft\internet explorer\quick launch\google chrome.lnk.ghostcry
- %LOCALAPPDATA%low\microsoft\internet explorer\services\search_{0633ee93-d776-472f-a0ff-e1416b8b2e3a}.ico.ghostcry
- %LOCALAPPDATA%\microsoft\windows mail\stationery\wrinkled_paper.gif.ghostcry
- %LOCALAPPDATA%\microsoft\windows mail\stationery\tiki.gif.ghostcry
- %LOCALAPPDATA%\microsoft\windows mail\stationery\stucco.gif.ghostcry
- %LOCALAPPDATA%\microsoft\windows mail\stationery\connectivity.gif.ghostcry
- %LOCALAPPDATA%\microsoft\windows mail\stationery\cave_drawings.gif.ghostcry
- %LOCALAPPDATA%\microsoft\windows\wer\reportqueue\critical_microsoft .net f_5deabd23d637fc27acf7bfdd613025667396c824_cab_0fbabd8f\microsoft .net framework 4.8 setup_20230912_173103134.html.ghost...
- %LOCALAPPDATA%\microsoft\windows\<INETFILES>\content.ie5\ea09503g\favicon[1].ico.ghostcry
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_sr.db.ghostcry
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_idx.db.ghostcry
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_96.db.ghostcry
- %LOCALAPPDATA%\microsoft\windows\explorer\thumbcache_256.db.ghostcry
- %HOMEPATH%\links\recentplaces.lnk.ghostcry
Changes user data files extensions (Trojan.Encoder).