Create ghostminer.txt
Create ghostminer.txt

```
GhostMiner will also install a WMI class named “PowerShell_Command” at the root\Default namespace. This WMI class contains the entries Command and CCBot that contains base-64 encoded functions.
...

Meanwhile, the CCBOT entry uses two IP addresses, namely 118[.]24[.]63[.]208 and 103[.]105[.]59[.]68, as C&C servers. It uses Base-64 to encode the send command and ROT-13, a letter substitution cipher that changes the 13th letter after it, to decode the received command.

We observed that the backdoor communication is only enabled between 12AM to 5AM. It uses an invoke-expression (IEX) when the C&C server receives a response. Otherwise, it will continuously try to connect to the abovementioned IP addresses every 30 seconds using the “/Update/CC/CC.php” URI path.
```
stamparm/maltrail,stamparm/maltrail,stamparm/maltrail,stamparm/maltrail