Behavioral task
behavioral1
Sample
f8170a2ef917ae06ec38452c3d8c7185_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
f8170a2ef917ae06ec38452c3d8c7185_JaffaCakes118
-
Size
235KB
-
MD5
f8170a2ef917ae06ec38452c3d8c7185
-
SHA1
7a58ee32062063ff592bad6b18b86fca60ad311b
-
SHA256
f01930098bb6c517aa9b1575ba865c19d0f4039871d68e6fed12607785b8d40c
-
SHA512
30d97e430c485dda38875d9de5ceff1d057921a73aa77f0a8643b8b3164eafb6768cf58928b8e1b54bbbc4b78cda588de3666970096be2d50441d3f339acad89
-
SSDEEP
6144:BS9V1iFf65Bg93TUGS9CSQJJkfFQqivYu2GYqgq1P:c9V0J9wAlJGQqiQq/P
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f8170a2ef917ae06ec38452c3d8c7185_JaffaCakes118
Files
-
f8170a2ef917ae06ec38452c3d8c7185_JaffaCakes118.exe windows:4 windows x86 arch:x86
0746a9e0fb0e6d8ee62bdea3ea8d29c2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
DeleteFileA
WriteFile
CreateProcessA
GetProcessHeap
HeapAlloc
GetCompressedFileSizeA
CreateDirectoryA
GetShortPathNameA
CopyFileA
WinExec
GetModuleHandleA
GetCurrentThreadId
GetSystemDirectoryA
FreeLibrary
GetWindowsDirectoryA
CreateThread
GetLastError
CloseHandle
Sleep
SetUnhandledExceptionFilter
ReadFile
lstrcmpA
GetCurrentProcess
GetModuleFileNameA
GetCommandLineA
CreateMutexA
ReleaseMutex
SetLastError
lstrcmpiA
lstrcpyA
GetTempPathA
GetTickCount
CreateFileA
lstrlenA
ExitProcess
lstrcatA
HeapFree
LoadLibraryA
GetProcAddress
user32
GetMessageA
PostThreadMessageA
GetInputState
wsprintfA
advapi32
GetLengthSid
ControlService
DeleteService
CloseServiceHandle
CreateServiceA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegRestoreKeyA
StartServiceA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
RegQueryValueExA
RegEnumKeyExA
RegEnumValueA
RegOpenKeyExA
RegCloseKey
LookupAccountNameA
GetFileSecurityA
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetAclInformation
InitializeAcl
EqualSid
AddAce
GetAce
AddAccessAllowedAce
SetSecurityDescriptorDacl
SetFileSecurityA
GetServiceKeyNameA
OpenSCManagerA
GetSecurityDescriptorControl
AddAccessDeniedAce
OpenServiceA
shell32
ShellExecuteA
shlwapi
PathFileExistsA
msvcrt
??2@YAPAXI@Z
_onexit
__dllonexit
??1type_info@@UAE@XZ
printf
rename
strchr
??3@YAXPAX@Z
_except_handler3
realloc
malloc
strncat
_strnicmp
strstr
__CxxFrameHandler
_CxxThrowException
Sections
.text Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 180KB - Virtual size: 180KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 30KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE