Overview

overview

10

Static

static

3

fc256a93b5...18.exe

windows7-x64

10

fc256a93b5...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fc256a93b5156ec53d91bfba443c5fc4_JaffaCakes118

  • Size

    712KB

  • Sample

    240420-ha9ddaaf94

  • MD5

    fc256a93b5156ec53d91bfba443c5fc4

  • SHA1

    15b7f491f9c76e0c5794891e5b4a1b1be790c43b

  • SHA256

    35d26f36349006acf717db7c12ab2173794ac3db5d6a754757ef018eec092289

  • SHA512

    98689431bd27a586da33090f02f5ac9e4a722ca8614a9f9f208728cc0775bb987b6ad3668f95905daba4356fe2b48550890e07b689555d89ea76ab59f43ed56e

  • SSDEEP

    12288:Xk8m2ASnta158A0at9nrJyH5yQ/8f5/0ReoLWeMv+:X42S0crUyP/doSN+

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      fc256a93b5156ec53d91bfba443c5fc4_JaffaCakes118

    • Size

      712KB

    • MD5

      fc256a93b5156ec53d91bfba443c5fc4

    • SHA1

      15b7f491f9c76e0c5794891e5b4a1b1be790c43b

    • SHA256

      35d26f36349006acf717db7c12ab2173794ac3db5d6a754757ef018eec092289

    • SHA512

      98689431bd27a586da33090f02f5ac9e4a722ca8614a9f9f208728cc0775bb987b6ad3668f95905daba4356fe2b48550890e07b689555d89ea76ab59f43ed56e

    • SSDEEP

      12288:Xk8m2ASnta158A0at9nrJyH5yQ/8f5/0ReoLWeMv+:X42S0crUyP/doSN+

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks