Behavioral task
behavioral1
Sample
f32992ff8f3a9bca23c1c7a2f8f4f292_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f32992ff8f3a9bca23c1c7a2f8f4f292_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
f32992ff8f3a9bca23c1c7a2f8f4f292_JaffaCakes118
-
Size
86KB
-
MD5
f32992ff8f3a9bca23c1c7a2f8f4f292
-
SHA1
b620d4c4bc95df939d943bcea8ed342650b48a21
-
SHA256
9c294d3a05885f2811e09eff45d2aa6a3429fba6d78daa3ede36fe08e58bc351
-
SHA512
2c1295077bec11bb4c23a90f33d168b7a4e288d743dffb790a42aa5dcb607f6c57612b7315ccc0ef5f72054ea4d1d46edb2aab056f6446dfb441d2e5fd84b93f
-
SSDEEP
1536:Ucw3G9FDMbbMt9ODnjfiwKcuybfLIeAwKJB4AY4eEtXreOv3/bRI:Pw29FIMDODn+wKByrLIeJKJBZ2EtbeO9
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f32992ff8f3a9bca23c1c7a2f8f4f292_JaffaCakes118
Files
-
f32992ff8f3a9bca23c1c7a2f8f4f292_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.data Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 76KB - Virtual size: 75KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ