Ghostcontainer Masquerading Executable Filenames

Arnold Chan@slaz

•updated 23 days ago•0•0•2

Detects PE executables whose embedded filename strings claim to be Adobe, TrueConf, or 1C software but whose PE metadata (company/product name) or digital signature does not match the claimed vendor, as used by NightEagle/GhostContainer operators to blend malicious tooling into normal process activity