gh0strat | fe5ae51a975c574691bb439e36d0a25c2ae64888fa2bd83d179a43b86e5dc2e8 | Triage

Submit
Reports

Overview

overview

Static

static

3

fe5ae51a97...18.exe

windows7-x64

fe5ae51a97...18.exe

windows10-2004-x64

Sharing

General

Target

fe5ae51a975c574691bb439e36d0a25c2ae64888fa2bd83d179a43b86e5dc2e8_JaffaCakes118
Size

572KB
Sample

240421-eb8lpaac27
MD5

95e5ca72df58cefa481b6b360bf7d5d3
SHA1

7a1ae2e8a75d01e269de4c2ad6067a4146593aac
SHA256

fe5ae51a975c574691bb439e36d0a25c2ae64888fa2bd83d179a43b86e5dc2e8
SHA512

2f04dedd6c10e02e01530f2055545550c1740c754eec26010e2009c3239315d120b420e5eaf3c42d22f75a1143a2027363370abde0afb686f2722f9a358288c5
SSDEEP

6144:iV+u0bUDMT2EDFjj4bflswu/jtLFVgT/WOfrtNswrEH7fYP7cQKO+3Y1tMmbWs:Ob3MKbflsw0t5VgLWYtHraOz+3Y12wW

Score

10^/10

gh0strat persistence rat

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

fe5ae51a975c574691bb439e36d0a25c2ae64888fa2bd83d179a43b86e5dc2e8_JaffaCakes118.exe

Resource

win7-20240221-en

gh0strat persistence rat

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

fe5ae51a975c574691bb439e36d0a25c2ae64888fa2bd83d179a43b86e5dc2e8_JaffaCakes118.exe

Resource

win10v2004-20240412-en

gh0strat persistence rat

windows10-2004-x64

6 signatures

150 seconds

Malware Config

Targets

- Target
  
  fe5ae51a975c574691bb439e36d0a25c2ae64888fa2bd83d179a43b86e5dc2e8_JaffaCakes118
- Size
  
  572KB
- MD5
  
  95e5ca72df58cefa481b6b360bf7d5d3
- SHA1
  
  7a1ae2e8a75d01e269de4c2ad6067a4146593aac
- SHA256
  
  fe5ae51a975c574691bb439e36d0a25c2ae64888fa2bd83d179a43b86e5dc2e8
- SHA512
  
  2f04dedd6c10e02e01530f2055545550c1740c754eec26010e2009c3239315d120b420e5eaf3c42d22f75a1143a2027363370abde0afb686f2722f9a358288c5
- SSDEEP
  
  6144:iV+u0bUDMT2EDFjj4bflswu/jtLFVgT/WOfrtNswrEH7fYP7cQKO+3Y1tMmbWs:Ob3MKbflsw0t5VgLWYtHraOz+3Y12wW
Score

10^/10

gh0strat persistence rat
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gh0stratpersistencerat

behavioral2

gh0stratpersistencerat

© 2018-2024

Terms | Privacy