Overview

overview

10

Static

static

3

fdb9c80a0d...18.exe

windows7-x64

10

fdb9c80a0d...18.exe

windows10-2004-x64

3

Sharing

Copy URL Twitter E-mail

General

  • Target

    fdb9c80a0da3937f08a5ab87e9d6a368_JaffaCakes118

  • Size

    264KB

  • Sample

    240420-1p73zabd8w

  • MD5

    fdb9c80a0da3937f08a5ab87e9d6a368

  • SHA1

    42ea86c4f9f7b284bc6b91cbd217ec0898b7b5f9

  • SHA256

    db08e8e975a26558319d0004e3f0fb987ba52fa67c36b43619ed8efd71f51675

  • SHA512

    68fc4ebdd96986eb0a1b2f0a87ddb969290a65cb34605bc9c6328fb3f9a4127ff6be723f1fd055f66db42aa3cb48cd28a619d56f316ff12a922eb4d06d4da17c

  • SSDEEP

    6144:0aEqaPougeuaRJ1ZL02vIMbZsXCv0vKvf8QLBBzAM+GuN8ZpQP:0I+geuaVOA9oCv0ClLbzL+GI

Score
10/10
gh0stratbootkitpersistencerat

Malware Config

Targets

    • Target

      fdb9c80a0da3937f08a5ab87e9d6a368_JaffaCakes118

    • Size

      264KB

    • MD5

      fdb9c80a0da3937f08a5ab87e9d6a368

    • SHA1

      42ea86c4f9f7b284bc6b91cbd217ec0898b7b5f9

    • SHA256

      db08e8e975a26558319d0004e3f0fb987ba52fa67c36b43619ed8efd71f51675

    • SHA512

      68fc4ebdd96986eb0a1b2f0a87ddb969290a65cb34605bc9c6328fb3f9a4127ff6be723f1fd055f66db42aa3cb48cd28a619d56f316ff12a922eb4d06d4da17c

    • SSDEEP

      6144:0aEqaPougeuaRJ1ZL02vIMbZsXCv0vKvf8QLBBzAM+GuN8ZpQP:0I+geuaVOA9oCv0ClLbzL+GI

    Score
    10/10
    gh0stratbootkitpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks