Behavioral task
behavioral1
Sample
f90200bd37018dbb0b711fcb7b65777f_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f90200bd37018dbb0b711fcb7b65777f_JaffaCakes118.exe
Resource
win10v2004-20240226-en
General
-
Target
f90200bd37018dbb0b711fcb7b65777f_JaffaCakes118
-
Size
82KB
-
MD5
f90200bd37018dbb0b711fcb7b65777f
-
SHA1
761829cfbf993d022ee1ffd4fb03e84532818831
-
SHA256
da99bff888363372dbae902a822c94f55856ea8c05d10afd558a61b6d09f23aa
-
SHA512
4391e64444ddf660a7871d2247be44767d4d0fc8a988588f94a52edfe5fddb6f1d2161a3281586201cdc9fe92e37e042e187674fa45531f99dd0006532fefead
-
SSDEEP
1536:YxGHch32i0UknxhNFcfpTfd4qwLF18oD5osP:Yx1vLknDHApzd4qwLooD5H
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f90200bd37018dbb0b711fcb7b65777f_JaffaCakes118
Files
-
f90200bd37018dbb0b711fcb7b65777f_JaffaCakes118.exe windows:4 windows x86 arch:x86
a4974c06312833c6b917b334df2f5f93
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
avicap32
capGetDriverDescriptionA
wininet
InternetOpenUrlA
InternetReadFile
InternetOpenA
InternetCloseHandle
kernel32
CreateFileA
GetFileAttributesA
GetWindowsDirectoryA
LocalFree
LocalSize
WriteFile
SetFilePointer
GetLastError
GetCurrentProcess
CreateProcessA
CreateThread
GetProcAddress
LoadLibraryA
TerminateThread
Process32Next
lstrcmpiA
Process32First
HeapAlloc
GetProcessHeap
VirtualProtect
IsBadReadPtr
HeapFree
FreeLibrary
GetSystemInfo
SetErrorMode
GetVersionExA
GetCurrentThreadId
DeleteCriticalSection
InitializeCriticalSection
VirtualFree
GetStartupInfoA
GetModuleHandleA
LeaveCriticalSection
Sleep
EnterCriticalSection
VirtualAlloc
CreateEventA
CloseHandle
GetFileSize
ReadFile
lstrlenA
LocalReAlloc
LocalAlloc
CancelIo
InterlockedExchange
SetEvent
lstrcpyA
ResetEvent
WaitForSingleObject
user32
CloseDesktop
wsprintfA
GetWindowTextA
ExitWindowsEx
PostMessageA
OpenDesktopA
GetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
SetThreadDesktop
advapi32
AllocateAndInitializeSid
LookupPrivilegeValueA
RegOpenKeyA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegQueryValueExA
RegEnumKeyExA
RegEnumValueA
OpenProcessToken
GetLengthSid
InitializeAcl
AddAccessAllowedAce
InitializeSecurityDescriptor
SetSecurityDescriptorDacl
RegSetKeySecurity
FreeSid
OpenEventLogA
ClearEventLogA
CloseEventLog
RegOpenKeyExA
RegQueryValueA
RegCloseKey
AdjustTokenPrivileges
msvcrt
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_mkdir
_stricmp
_strnicmp
__setusermatherr
_initterm
__getmainargs
_acmdln
_XcptFilter
__CxxFrameHandler
_CxxThrowException
??3@YAXPAX@Z
memmove
ceil
_ftol
strstr
??2@YAPAXI@Z
puts
malloc
strrchr
atoi
strncmp
strncpy
free
strchr
_errno
exit
realloc
_except_handler3
strncat
_beginthreadex
calloc
??1type_info@@UAE@XZ
__dllonexit
_onexit
_exit
_strcmpi
ws2_32
gethostbyname
socket
ntohs
recv
closesocket
select
htons
inet_ntoa
inet_addr
getsockname
bind
getpeername
accept
listen
sendto
recvfrom
__WSAFDIsSet
gethostname
WSAStartup
WSACleanup
WSAIoctl
setsockopt
connect
send
urlmon
URLDownloadToFileA
wtsapi32
WTSFreeMemory
WTSQuerySessionInformationA
Sections
.text Size: 59KB - Virtual size: 59KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 7KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ