gh0strat

General

Target

e89a03e73f12ec65040118c69b721c59_JaffaCakes118
Size

193KB
Sample

240408-2qjbnsea72
MD5

e89a03e73f12ec65040118c69b721c59
SHA1

980308df2d39e456c817215abcc335c9cf9333a4
SHA256

93e486554efa71e0da46388de32bc0be4c41948b18b4590990944bbc5344f868
SHA512

daa81389d1f8be7f1dec2b345f3b2ff764bcc83ab817d72754f990253537fb7437d463b0be39d5b5fc15134a510a651df7bc8b23df13c1af45c79df40d800b1b
SSDEEP

3072:ALk395hYXJkjSUxWpWdlP926IYWls7QddsouZnpyM8HERlJciF2zM1DDF6Q:AQqqjSlpWdlPgkQgoBERciFj1HF6Q

Score

10^/10

Malware Config

Targets

- Target
  
  e89a03e73f12ec65040118c69b721c59_JaffaCakes118
- Size
  
  193KB
- MD5
  
  e89a03e73f12ec65040118c69b721c59
- SHA1
  
  980308df2d39e456c817215abcc335c9cf9333a4
- SHA256
  
  93e486554efa71e0da46388de32bc0be4c41948b18b4590990944bbc5344f868
- SHA512
  
  daa81389d1f8be7f1dec2b345f3b2ff764bcc83ab817d72754f990253537fb7437d463b0be39d5b5fc15134a510a651df7bc8b23df13c1af45c79df40d800b1b
- SSDEEP
  
  3072:ALk395hYXJkjSUxWpWdlP926IYWls7QddsouZnpyM8HERlJciF2zM1DDF6Q:AQqqjSlpWdlPgkQgoBERciFj1HF6Q
Score

10^/10

gh0strat persistence rat
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2
- Target
  
  201151922243.exe
- Size
  
  25.1MB
- MD5
  
  2f30d031eceaa35e41d78363747f9182
- SHA1
  
  c5d467e10167330cdc5c4d859a81ffdd0c1ac101
- SHA256
  
  52ab1dfca531c1b409af062478f1926d86fec266fe1c90a61c70676633cef8a5
- SHA512
  
  b4729afc5910f8b37ef0b5a2591b52b13da5fd0d259ef8f5af1e798f71c9630d9b004dca8301b5d7a820d516d86ddc198ae52eb43a22edc1a73a1a830bd9c71d
- SSDEEP
  
  3072:ALk395hYXJ708xqm3AdPSNtQ0SH54TiQgIwNxHv/YZzwCrddCnIsJBXc:AQqB00R3AdYbOUoIwNlnDCrddCxdc
Score

10^/10

gh0strat persistence rat
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral3 behavioral4
- Target
  
  2011519222254.exe
- Size
  
  308KB
- MD5
  
  a8247344600b8cdf4f8debe3c8493ba8
- SHA1
  
  bbc3ac5475dcdb16c4f38a180dbefb8dcefce4d0
- SHA256
  
  639cbbed21a4c8cbf9d63ef3952fdc0078a816e4703b2c91557dce082d7d0063
- SHA512
  
  cfa753ae805fd21db0fd1fea23f65b59173c589c77ea5fd73a9471647751c82d3d6d3d08f2a92a056a3e13f13fc93e8e9eb88fb5dd79d008232a27badfa994dd
- SSDEEP
  
  6144:yiTtiWB0wL7t9J5Gp34EnBC4G7v4G7AWF5:5XB0wd9rGN7BEJAi
Score

10^/10

gh0strat persistence rat
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Adds Run key to start application
  persistence
behavioral5 behavioral6