gh0strat | ffb8652cccf032a7d6e7db7cce1cd4b9_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
ffb8652cccf032a7d6e7db7cce1cd4b9_JaffaCakes118
Size 117KB
Sample240421-t524bsfc52
SHA256 3631b64b9fbecc89f233a16b4c572341d9deaa8b6459d68c092341758df3e69b
MD5 ffb8652cccf032a7d6e7db7cce1cd4b9
SHA1 3c91c8cb295cb1e01255d20a1f72db31a76afeab
SHA512 5a59f54b6cd7d12855ea0462936c85e576603966242eef664ed128ef8bd9f1d93bb98aa1eb29a363edcc41828283872c1ac95d796294e79d97845903372fabc1
SSDEEP 1536:71Ok/YOFlRSTRF6LmTOEeQFGckNVfcgdywXdtf/yGMdUWVrm/goVQrCvDcfP:71Ok/H9acbEeQErNNcgdy2/yB3VAx7cX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ffb8652cccf032a7d6e7db7cce1cd4b9_JaffaCakes118

File Explorer

ffb8652cccf032a7d6e7db7cce1cd4b9_JaffaCakes118

.dll 117KB

ffb8652cccf032a7d6e7db7cce1cd4b9_JaffaCakes118

IMPHASH c1c0b80452699b3e3f53aa7d8c736445
SHA256 3631b64b9fbecc89f233a16b4c572341d9deaa8b6459d68c092341758df3e69b
MD5 ffb8652cccf032a7d6e7db7cce1cd4b9
SHA1 3c91c8cb295cb1e01255d20a1f72db31a76afeab
SHA512 5a59f54b6cd7d12855ea0462936c85e576603966242eef664ed128ef8bd9f1d93bb98aa1eb29a363edcc41828283872c1ac95d796294e79d97845903372fabc1
SSDEEP 1536:71Ok/YOFlRSTRF6LmTOEeQFGckNVfcgdywXdtf/yGMdUWVrm/goVQrCvDcfP:71Ok/H9acbEeQErNNcgdy2/yB3VAx7cX
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Gh0st RAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

79502

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GlobalUnlock GlobalLock GlobalAlloc GlobalSize OutputDebugStringA GetStartupInfoA CreatePipe DisconnectNamedPipe TerminateProcess PeekNamedPipe WaitForMultipleObjects DeviceIoControl GlobalMemoryStatus GlobalFree OpenEventA SetErrorMode SetUnhandledExceptionFilter ExitProcess DisableThreadLibraryCalls FreeConsole SetFileAttributesA CopyFileA CreateMutexA CreateToolhelp32Snapshot GetCurrentThreadId RaiseException LocalSize UnmapViewOfFile CreateRemoteThread HeapAlloc GetCurrentProcess Process32First Process32Next GetSystemDirectoryA lstrcmpiA CreateFileMappingA GetModuleFileNameA MoveFileA WriteFile SetFilePointer ReadFile CreateFileA GetFileSize RemoveDirectoryA LocalAlloc FindFirstFileA LocalReAlloc FindNextFileA LocalFree FindClose GetLogicalDriveStringsA GetVolumeInformationA GetDiskFreeSpaceExA GetDriveTypeA CreateProcessA GetFileAttributesA CreateDirectoryA GetLastError DeleteFileA GetVersionExA GetPrivateProfileStringA lstrcmpA WideCharToMultiByte MultiByteToWideChar LoadLibraryA GetProcAddress FreeLibrary GetWindowsDirectoryA lstrcatA GetPrivateProfileSectionNamesA lstrlenA lstrcpyA Sleep CancelIo InterlockedExchange ResetEvent VirtualAlloc MapViewOfFile GetProcessHeap HeapFree GetTickCount GetLocalTime MoveFileExA OpenProcess VirtualAllocEx SetLastError WriteProcessMemory EnterCriticalSection LeaveCriticalSection CreateEventA VirtualFree DeleteCriticalSection InitializeCriticalSection CreateThread ResumeThread SetEvent WaitForSingleObject TerminateThread CloseHandle DuplicateHandle

user32

UnhookWindowsHookEx LoadCursorA DestroyCursor BlockInput SystemParametersInfoA SendMessageA keybd_event MapVirtualKeyA SetCapture WindowFromPoint SetCursorPos mouse_event SetWindowsHookExA SetClipboardData EmptyClipboard OpenClipboard GetClipboardData GetSystemMetrics SetRect ReleaseDC GetCursorInfo GetCursorPos GetDC SetProcessWindowStation IsWindow CloseWindow CreateWindowExA DispatchMessageA CallNextHookEx GetKeyNameTextA GetActiveWindow EnumWindows GetWindowTextA ExitWindowsEx MessageBoxA CloseClipboard TranslateMessage GetMessageA wsprintfA CharNextA PostMessageA OpenDesktopA GetThreadDesktop GetUserObjectInformationA OpenInputDesktop SetThreadDesktop CloseDesktop IsWindowVisible GetWindowThreadProcessId GetProcessWindowStation OpenWindowStationA

gdi32

GetDIBits BitBlt DeleteDC DeleteObject CreateDCA CreateCompatibleDC CreateDIBSection SelectObject CreateCompatibleBitmap

advapi32

LsaClose ControlService DeleteService CloseServiceHandle RegOpenKeyExA RegQueryValueA RegCloseKey LsaFreeMemory LsaOpenPolicy LsaRetrievePrivateData LookupAccountNameA IsValidSid OpenServiceA OpenSCManagerA RegSetValueExA RegCreateKeyA RegQueryValueExA RegOpenKeyA CreateServiceA RegCreateKeyExA CloseEventLog ClearEventLogA OpenEventLogA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken FreeSid SetSecurityDescriptorDacl AddAccessAllowedAce InitializeAcl GetLengthSid AllocateAndInitializeSid InitializeSecurityDescriptor RegEnumValueA RegEnumKeyExA RegDeleteValueA RegDeleteKeyA RegQueryInfoKeyA UnlockServiceDatabase ChangeServiceConfigA LockServiceDatabase StartServiceA QueryServiceConfigA EnumServicesStatusA CreateProcessAsUserA SetTokenInformation DuplicateTokenEx RegisterServiceCtrlHandlerA SetServiceStatus LookupAccountSidA GetTokenInformation QueryServiceStatus

shell32

SHGetFileInfoA SHGetSpecialFolderPathA

msvcrt

_strnicmp _strrev ??1type_info@@UAE@XZ _strupr _adjust_fdiv _initterm _onexit __dllonexit _strcmpi calloc _beginthreadex _mbschr _stricmp wcstombs strncat strtok atoi time localtime sprintf strncpy strrchr _except_handler3 free malloc strchr _CxxThrowException strstr _ftol ceil memmove __CxxFrameHandler ??3@YAXPAX@Z ??2@YAPAXI@Z

winmm

waveOutReset waveOutUnprepareHeader waveOutClose waveInUnprepareHeader waveInReset waveInStop waveOutWrite waveOutGetNumDevs waveOutOpen waveOutPrepareHeader waveInGetNumDevs waveInStart waveInAddBuffer waveInClose waveInPrepareHeader waveInOpen

ws2_32

getsockname closesocket recv WSAStartup WSAIoctl setsockopt connect htons gethostbyname socket send gethostname select WSACleanup

msvcp60

?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?_Xran@std@@YAXXZ ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z

imm32

ImmReleaseContext ImmGetContext ImmGetCompositionStringA

wininet

InternetOpenA InternetReadFile InternetCloseHandle InternetOpenUrlA

msvfw32

ICSeqCompressFrame ICSeqCompressFrameEnd ICCompressorFree ICSeqCompressFrameStart ICSendMessage ICOpen ICClose

wtsapi32

WTSFreeMemory WTSQueryUserToken WTSQuerySessionInformationA

userenv

CreateEnvironmentBlock

Name

.text

Size

94KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

PAGE

Size

640B

Virtual Size

640B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

file

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

install

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

defaul

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

msvcrt

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

sys

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

912B

Virtual Size

904B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ffb8652cccf032a7d6e7db7cce1cd4b9_JaffaCakes118

kernel32

user32

gdi32

advapi32

shell32

msvcrt

winmm

ws2_32

msvcp60

imm32

wininet

msvfw32

wtsapi32

userenv

generic