Behavioral task
behavioral1
Sample
f9341cc1755bf7ceeeeed341c4acf333_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
f9341cc1755bf7ceeeeed341c4acf333_JaffaCakes118
-
Size
252KB
-
MD5
f9341cc1755bf7ceeeeed341c4acf333
-
SHA1
68786e95a7c19cfd81212dfe452e11c61f66ba3a
-
SHA256
ba97c387f9fabe2326708fed2a23a9a7a09e844d2875c0978f790cfb46e2e77c
-
SHA512
26141eab9023072f323902c3b49c60e72067ad47eafcdd76dfc9ebdd2e1b74a8b6c67f068f3b4d4a0f4d1893bdb9f95420c2d2c9d788ee5e24838033db3c4ed0
-
SSDEEP
3072:hit+tUxCt0dPhgfBWHWVKhqvEzO/V1VrNYQkCA+HFSWvF3TBftInob2:Qn5QWHA9DNYtEHhvF3TBlInob
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f9341cc1755bf7ceeeeed341c4acf333_JaffaCakes118
Files
-
f9341cc1755bf7ceeeeed341c4acf333_JaffaCakes118.exe windows:4 windows x86 arch:x86
edada803b25662af6e5310b95af49338
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitProcess
lstrcatA
lstrcpyA
GetModuleFileNameA
DeleteFileA
EndUpdateResourceA
UpdateResourceA
BeginUpdateResourceA
ReadFile
GetFileSize
MoveFileA
WritePrivateProfileStringA
lstrlenA
SetFilePointer
Sleep
CloseHandle
WriteFile
CreateFileA
LoadResource
SizeofResource
FindResourceA
GetLocalTime
WinExec
GetCurrentThreadId
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
SetStdHandle
LoadLibraryA
GetProcAddress
GetOEMCP
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
GetLastError
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
FlushFileBuffers
user32
wsprintfA
GetMessageA
PostThreadMessageA
GetInputState
ole32
CoCreateGuid
CoInitialize
CoUninitialize
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 212KB - Virtual size: 210KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ