AI-IOC-cd905bf44c48
medium
📛 Threat Title
GhostNet malware
Description
The string appears to be a PowerShell script related to the GhostNet malware campaign. Hash values of PowerShell scripts are often used as indicators of compromise due to their potential to spread malware.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_md5
drain_ghost_kernel_85901.ps1
VT: not in VT
IOC database
- Type
- hash_md5
- Value
drain_ghost_kernel_85901.ps1- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- AI-validated IOC. The string appears to be a PowerShell script related to the GhostNet malware campaign. Hash values of PowerShell scripts are often used as indicators of compromise due to their potential to spread malware.
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: not in VT
References (0)
No references collected yet.
Remediations (10)
-
web:en.wikipedia.org
GhostNet (simplified Chinese: 幽灵网; traditional Chinese: 幽靈網; pinyin: YōuLíngWǎng) is the name given by researchers at the Information Warfare Monitor to a large-scale cyber spying operation discovered in March 2009. [1][2] The operation is likely associated with an advanced persistent threat, or a network actor that spies undetected. [3] Its command and control infrastructure is ...
-
web:pdfs.semanticscholar.org
The proposed model combines the capabil‐ ities of GhostNet Gated Recurrent Unit (GRU) and an optimization technique, Jaya Algo‐ rithm (JA), resulting in a more eficient and accurate malware detection and classification process.
-
web:rasec.app
Analyze the 2026 Ghostnet threat vector targeting abandoned infrastructure. Learn to secure legacy devices and mitigate network risks with RaSEC tools.
-
web:www.academia.edu
systems Article Enhancing Smart IoT Malware Detection: A GhostNet‑based Hybrid Approach Abdulwahab Ali Almazroi 1, * and Nasir Ayub 2 1 Department of Information Technology, College of Computing and Information Technology at Khulais, University of Jeddah, Jeddah 21959, Saudi Arabia 2 Department of Creative Technologies, Air University Islamabad, Islamabad 44000, Pakistan; [email protected ...
-
web:www.infosecinstitute.com
They led to the discovery of a complex malware -based cyber-exploitation network dubbed GhostNet . Short Summary of the Key Findings Records, samples, data, and analysis serve as evidence for the existence of the wide-ranging cyber-exploitation network GhostNet , contaminating minimum 1,295 computers in 103 countries.
-
web:www.mdpi.com
This research paper introduces an ensembler model designed to detect and classify malware on Internet of Things (IoT) devices. The proposed model combines the capabilities of GhostNet Gated Recurrent Unit (GRU) and an optimization technique, Jaya Algorithm (JA), resulting in a more efficient and accurate malware detection and classification ...
-
web:www.nature.com
This paper proposes a novel malware detection method based on an improved GhostNetV2, aimed at enhancing the detection performance for both normal malware and adversarial samples.
-
web:www.researchgate.net
Our GhostNet ensemble, combined with the Gated Recurrent Unit Ensembler (GNGRUE), is trained on these datasets and fine-tuned using the Jaya Algorithm (JA) to identify and categorize malware .
-
web:www.researchgate.net
Malware,atypeofharmful software,caninfiltratecomputersystems,networks,anddevices,causingsignificantdam‑ age.Astheseattacksbecomemoreadvanced,theybecomehardertostopusingtraditional ...
-
web:www.semanticscholar.org
A thorough survey of static IoT malware detection, introducing the definition, evolution and security threats of IoT malware , and carrying out exactly the methods of existing studies based on the same IoT malware dataset and an experimental configuration to evaluate objectively and increasing the reliability of these studies in detecting IoT ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.