home

OneKeyGhost.exe

OneKey Ghost

OneKey.Cc

This is a setup program which is used to install the application. The file has been seen being downloaded from doc-0o-08-docs.googleusercontent.com and multiple other hosts.
Publisher:
OneKey.Cc

Product:
OneKey Ghost

Description:
一键还原

Version:
13.4.5.203

MD5:
a64e374945845aaec6ad063e8be450db

SHA-1:
765c30dcfe127cb9c7c246ffa5ebb35040e1ee82

SHA-256:
46d0413084564b4de78218ab73cac481743d6c5756b13fd4ffec7c897b8f75d8

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/2/2024 9:30:22 AM UTC  (today)

File size:
3.8 MB (3,982,360 bytes)

Product version:
20130405

Copyright:
Copyright (C) 2005-2013 OneKey.Cc

Trademarks:
OneKey Ghost

Original file name:
OneKeyGhost.exe

File type:
Executable application (Win32 EXE)

Language:
Chinese (Simplified, China)

Common path:
C:\users\{user}\downloads\onekeyghost.exe

File PE Metadata
Compilation timestamp:
4/10/2012 2:11:21 AM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
10.0

CTPH (ssdeep):
98304:HkpOWMJrMHGo5Bp+6IOYMCT2oOB9sQJ7OW24JRTlnm:EPMJ4Hj+IYMK2zB9tJ712yRM

Entry address:
0xC5990

Entry point:
60, BE, 00, 10, 48, 00, 8D, BE, 00, 00, F8, FF, 57, 89, E5, 8D, 9C, 24, 80, C1, FF, FF, 31, C0, 50, 39, DC, 75, FB, 46, 46, 53, 68, 90, 31, 0C, 00, 57, 83, C3, 04, 53, 68, 84, 49, 04, 00, 56, 83, C3, 04, 53, 50, C7, 03, 03, 00, 02, 00, 90, 90, 90, 90, 90, 55, 57, 56, 53, 83, EC, 7C, 8B, 94, 24, 90, 00, 00, 00, C7, 44, 24, 74, 00, 00, 00, 00, C6, 44, 24, 73, 00, 8B, AC, 24, 9C, 00, 00, 00, 8D, 42, 04, 89, 44, 24, 78, B8, 01, 00, 00, 00, 0F, B6, 4A, 02, 89, C3, D3, E3, 89, D9, 49, 89, 4C, 24, 6C, 0F, B6, 4A...
 
[+]

Code size:
280 KB (286,720 bytes)

The file OneKeyGhost.exe has been seen being distributed by the following 24 URLs.

https://doc-0o-08-docs.googleusercontent.com/docs/securesc/6qlh1f3bcs759v9cc8j7ef8dh4c424kp/tg5ni2p100dutfdmq6lu130bmbbrocsq/1484712000000/.../00258846454461226517/0B8nV-Lp9XY9ARWk0UEx3NnpWQlk?e=download

temp:onekey-ghost_setup.exe

http://f30.x8top.net/2107tmp/cf/soft/2014/7/ba/.../onekey-ghost_setup.exe

browser.exe

http://f3.softwaretop.net/tmp/cf/soft/2014/7/ba/.../onekey-ghost_setup.exe

ftp://hangkhung.gcafe.vn/01.Softwares/OneyKeyGhost13.4.5/.../OneKeyGhost.exe

http://c236.y8top.net/2107tmp/cf/soft/2014/7/ba/.../onekey-ghost_setup.exe

http://f30.y8top.net/2107tmp/cf/soft/2014/7/ba/.../onekey-ghost_setup.exe

http://f51.y8top.net/2107tmp/cf/soft/2014/7/ba/.../onekey-ghost_setup.exe

http://f51.x8top.net/2107tmp/cf/soft/2014/7/ba/.../onekey-ghost_setup.exe

http://c236.x8top.net/2107tmp/cf/soft/2014/7/ba/.../onekey-ghost_setup.exe

ftp://10.115.0.12/CONGTY/CNTT/Mr_Linh/.../onekey-ghost_setup.exe

http://c236.softwaretop.net/2107tmp/cf/soft/2014/7/ba/.../onekey-ghost_setup.exe

http://f50.softwaretop.net/2107tmp/cf/soft/2014/7/ba/.../onekey-ghost_setup.exe

http://f25.softwaretop.net/tmp/cf/soft/2014/7/ba/.../onekey-ghost_setup.exe

http://f30.softwaretop.net/2107tmp/cf/soft/2014/7/ba/.../onekey-ghost_setup.exe

http://f20.softwaretop.net/tmp/cf/soft/2014/7/ba/.../onekey-ghost_setup.exe

http://galileo.myvnc.com/galileo software/.../OneKeyGhost.exe

http://c36.softwaretop.net/2107tmp/cf/soft/2014/7/ba/.../onekey-ghost_setup.exe

http://f51.softwaretop.net/2107tmp/cf/soft/2014/7/ba/.../onekey-ghost_setup.exe

http://f35.softwaretop.net/2107tmp/cf/soft/2014/7/ba/.../onekey-ghost_setup.exe

https://6e89ee0a00e07858c94813758e47b86d120acf51.googledrive.com/host/.../OneKeyGhost.exe

https://googledrive.com/host/.../OneKeyGhost.exe

https://doc-0c-7g-docsviewer.googleusercontent.com/viewer/securedownload/dsn1aovipa7l846lsfcf94nedj8q2p4u/a9lcbjq2h2iaqr4nndanlqv1br54842f/1388774700000/c2l0ZXM=/.../WkdWbVlYVnNkR1J2YldGcGJueHpjR1ZsWkhWd2JHRndkRzl3YzN4bmVEb3pPRFEzWVRVNE16ZzFZMk5tTVRNMw==?a=dl&filename=OneKeyGhost.zip&sec=AHSqida1YqRavWP4AoyDwOem2TkQ05u63n92WWd4z9nll6SCj0Cknvqb5Fh0aDjF18FJX8jee0oA&rel=zip;z1;OneKeyGhost.exe

Scan OneKeyGhost.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.