gh0strat | ff9a0067b5b1701670f9ac24b87c6992_JaffaCakes118

resource	yara_rule
sample	family_gh0strat

resource
ff9a0067b5b1701670f9ac24b87c6992_JaffaCakes118

ff9a0067b5b1701670f9ac24b87c6992_JaffaCakes118

IMPHASH df0d3bf75c26a6838d2c3b958d751b10
SHA256 a86e2d8e833910b655ec60bff7a47fe74210e805e2098aa4c78c2ea6660e7284
MD5 ff9a0067b5b1701670f9ac24b87c6992
SHA1 92c5d7e233864870442dadcaf95b5561b5d6d898
SHA512 4aaec3761baa87cab7160600b2a18522f4aac642d142317d4cdb2ce9b81b5016612b94975b9212ce87b42a39d4ac4183577ebd492b3e01620db4800687c6729b
SSDEEP 3072:VbAsU4cQIuP1YTzA42vdwe5jma/cQbqRNbqI6ZzO583Q:VzIa8Afvqem4yRMnzO+A
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Gh0st RAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5264

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

.data

SHA256 e9a72cfacad3b4a69954ec3d3c873b7dfa3a653f8ea631aee98985dc92692600
MD5 25d8cf740951f9f95c8a69272c53db68
SHA1 ff5da106b604e66ef00b004303ae13ebd709ce48
SHA512 99204a1a146937905da467a0075fa203a0c4ffa66a432390f2b18ddfe6bb9e50d45c5180645aa69b5619bed0a8ec932bb0dfb53094eb142665b933fb48f8695d
SSDEEP 192:Powzz2ElXUt7GJikDMqQYHl020J4lj+fzARyUeDA2fLx:D7AEr+fztUmTt
MD5 SHA1 SHA512 SSDEEP

Gh0st RAT payload

.rdata

SHA256 4799632390cbfe3a1bb964f649b8d0f342833bd8da9c94edfb134845abf53fbd
MD5 d5971af2518f1c3ccf1592bd53173960
SHA1 7fed5835864ddcc9178ab481ec574283ab2fcf71
SHA512 fc8a190d49b5aa103a26e9c8c42ad7c3b737552808736b8c95330d48ad8ce3030fbf81dd5c81505bbb28e1e1e0682d1f0824b575ea20ccf0a1c01b76f3cfcac9
SSDEEP 384:eZb0UPoB4i/c8KMZb0UPo0U67RrKRtyYzl89ng:eZbqRjZbqwRr2YYzO
MD5 SHA1 SHA512 SSDEEP

Gh0st RAT payload

.reloc

SHA256 549a4cd098fec26c87178bda314ac204e1ae71102e2110d3d9a7eb3e50078ced
MD5 8f43027c1994dbb8fb056dfaec6d8a25
SHA1 6ecc847b803e2b79134def4859bfbc8b1c9071ed
SHA512 60c0ecb157c9cf8d58e07b2c4a5c1fc354ebc9fa91632db821d1d51068677865a6d8b3b8f2f2c572711dfab7f23dc4ee9550a9504f7a4ec42c48686c864f2842
SSDEEP 96:Fd2AlD4ADVcGtYa0eUHt/x7DXkFSrzyVwG930yS3aViC:F0AWTk9hUH/XkFSrGVwG+xBC
MD5 SHA1 SHA512 SSDEEP

Gh0st RAT payload

.rsrc/MANIFEST/1

SHA256 35b7d03732d6f5834ca165995ac2985880c2ac0c13b0d9c60a23edc9e0ae11e3
MD5 3094519c13cf5858434d62962a7658c1
SHA1 e86d3c8fd3cc71adc15e9b51ef5b30cc0921e275
SHA512 b2170898588303d5c858502fc12c8d8412b088bd1ed1b2d6242183db3e8e6c7de8f0c1480a292f481fae2b7ba189f16ceeb8ac63e8c2e9c79da0f1696fd37428
MD5 SHA1 SHA512

Gh0st RAT payload

.text

SHA256 f283e91bafb43ac44fabc877f9e0651d39a9490367302e6795243681973685c8
MD5 40616b19deeacf3d713ca2f305b48636
SHA1 825fc6b0c6fdc01f8ef4ae03d8a84a6ce80bcbda
SHA512 3aaec66ae58eb66b8e16831bbbf44e67556264922c9ecf63c2cd643ba6ad3ff7d176e21f90f82f6b41caf033bbd36c3ce499d0f5a2dc827f11b979d5b7d44d4b
SSDEEP 1536:Exuvkert9iaBhEFi7iIuPMXj4YTzxstPARAkekqwec2j0fa/cp:EAsU4cQIuP1YTzA42vdwe5jma/c
MD5 SHA1 SHA512 SSDEEP

Gh0st RAT payload

ff9a0067b5b1701670f9ac24b87c6992_JaffaCakes118

kernel32

user32

gdi32

advapi32

msvcrt

generic

.data

.rdata

.reloc

.rsrc/MANIFEST/1

.text

Sharing

General

Malware Config

Signatures

File Explorer

ff9a0067b5b1701670f9ac24b87c6992_JaffaCakes118

kernel32

user32

gdi32

advapi32

msvcrt

generic

.data

.rdata

.reloc

.rsrc/MANIFEST/1

.text