Overview

overview

10

Static

static

3

fbce6a7019...18.exe

windows7-x64

10

fbce6a7019...18.exe

windows10-2004-x64

10

Seel.exe

windows7-x64

10

Seel.exe

windows10-2004-x64

10

nw_elf.exe

windows7-x64

1

nw_elf.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fbce6a70198854557fbeca0f09587758_JaffaCakes118

  • Size

    371KB

  • Sample

    240420-dr5djafg8v

  • MD5

    fbce6a70198854557fbeca0f09587758

  • SHA1

    0b913a3dbfe070b927b197462eba5033ab88dd4b

  • SHA256

    a9005337ee42d933713cdb8fe8a777d36403b37649676ceb2d2c2417a8e91a04

  • SHA512

    487a428dad968f6b13e9964e7c30bbcdc1c8254d41188a9d28dd51b78d396974c65df3aac2d69cf50994c23c9a598649e5f0b4d3709c28b586531f969ba40e5e

  • SSDEEP

    6144:cQqek/BOtrgHyI/cXqUul/R0dPE1Nxw6sLcWaWPve1BQ4rO4Xc6dzO3cAO/mQ:8Vy5hWRecPxw6icWaWPvenAqD7

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      fbce6a70198854557fbeca0f09587758_JaffaCakes118

    • Size

      371KB

    • MD5

      fbce6a70198854557fbeca0f09587758

    • SHA1

      0b913a3dbfe070b927b197462eba5033ab88dd4b

    • SHA256

      a9005337ee42d933713cdb8fe8a777d36403b37649676ceb2d2c2417a8e91a04

    • SHA512

      487a428dad968f6b13e9964e7c30bbcdc1c8254d41188a9d28dd51b78d396974c65df3aac2d69cf50994c23c9a598649e5f0b4d3709c28b586531f969ba40e5e

    • SSDEEP

      6144:cQqek/BOtrgHyI/cXqUul/R0dPE1Nxw6sLcWaWPve1BQ4rO4Xc6dzO3cAO/mQ:8Vy5hWRecPxw6icWaWPvenAqD7

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

    • Target

      Seel.exe

    • Size

      192KB

    • MD5

      5b14b65e3d82b9105a6716d57c94b2ab

    • SHA1

      ebdff3e9b9b9ff4d1b62fd0d66238ac76923d6f4

    • SHA256

      907197572441adc0d0f205079b80005e5f484bee40dbdbd25abd65e157b4942b

    • SHA512

      2204a82c2c896c446f4488b536d1606195112b3ed98c3af52acb7895101ddf8241a7266a35388fb841827d3b5444d567e8711392ba9d62079bb8d0eadee44b78

    • SSDEEP

      3072:V8B9tMfP9ZGFwgvRLLCzOYFDq+UdnIPPlMzcsofIw+KaX0LcHLkMIIRi:V6M96wgvRHCzOYtqlGyzcsX3KA0LQIQI

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral3behavioral4

    • Target

      nw_elf.exe

    • Size

      573KB

    • MD5

      b51f17be01243934bd9b507bb3082498

    • SHA1

      9cd50f951518c4ab68d6140663c80d4688849823

    • SHA256

      c286536081ae21b1210e9b2d44cad98ba7849dcfcc1e3c864e9e60216682bd27

    • SHA512

      68e801a23508d0e30975df618b15840ee588b4ffa5ce2a8ca1a710886559e45a7e37b25d5626d802fb5434820992f362815e335123352aab8867dad44732f2ab

    • SSDEEP

      6144:zRK2IIXtxecGD13Z+09dAklAbHc0geJWTo+hI//GWlUEJeaZSAET:zRKl8xiDVdAkybHc0jWTo+inGWlde62T

    Score
    1/10
    behavioral5behavioral6

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks