Overview

overview

10

Static

static

3

fadfd6c0e9...18.exe

windows7-x64

10

fadfd6c0e9...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    fadfd6c0e923c415df565b0d65cbaa36_JaffaCakes118

  • Size

    128KB

  • Sample

    240419-wqa3eacc7s

  • MD5

    fadfd6c0e923c415df565b0d65cbaa36

  • SHA1

    bb3c8de447bfd96e0d943e0be6119d3f120315b7

  • SHA256

    f13fd8556e74d78a823b4e3ebda9b795aec991fd288189cea8c1ba000bd3fca8

  • SHA512

    cf2aec4dc58ad6e92807b16026ac35d7608054c2760c16457f4dbc3af64bb7873660742260db37ff770753a9702120eac3b4af94d3992ee101784170b6d1373f

  • SSDEEP

    1536:sABxSLGG2SgtCL6moht+huuODANeqdouDPgDsIlWguxaz2BqQ40E+0bQTrz:vBxSYtCmthtfD+ekDPeBu22h40fmq/

Score
10/10
gh0stratrat

Malware Config

Targets

    • Target

      fadfd6c0e923c415df565b0d65cbaa36_JaffaCakes118

    • Size

      128KB

    • MD5

      fadfd6c0e923c415df565b0d65cbaa36

    • SHA1

      bb3c8de447bfd96e0d943e0be6119d3f120315b7

    • SHA256

      f13fd8556e74d78a823b4e3ebda9b795aec991fd288189cea8c1ba000bd3fca8

    • SHA512

      cf2aec4dc58ad6e92807b16026ac35d7608054c2760c16457f4dbc3af64bb7873660742260db37ff770753a9702120eac3b4af94d3992ee101784170b6d1373f

    • SSDEEP

      1536:sABxSLGG2SgtCL6moht+huuODANeqdouDPgDsIlWguxaz2BqQ40E+0bQTrz:vBxSYtCmthtfD+ekDPeBu22h40fmq/

    Score
    10/10
    gh0stratrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks