Behavioral task
behavioral1
Sample
fff2bba9f36cc86a17164c6fc387cf1b_JaffaCakes118.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
fff2bba9f36cc86a17164c6fc387cf1b_JaffaCakes118.exe
Resource
win10v2004-20240412-en
General
-
Target
fff2bba9f36cc86a17164c6fc387cf1b_JaffaCakes118
-
Size
104KB
-
MD5
fff2bba9f36cc86a17164c6fc387cf1b
-
SHA1
cae960e5bf19909f8ec5e3d5e824942d014389ca
-
SHA256
708d907df32e8cc33d562f1136e50f59d21cffd4e1f886801760fca7d191fdcf
-
SHA512
e4bab5c2a3e3f75349ba617caec8a2ac29ae01607425a55dc75e6bfd653040057b73fccdade28b0565aff94d0e87db6a39d23c717c7e0948f269a440e93f4163
-
SSDEEP
1536:btAiY4GiNpjr5Y/xRQcudifCe+W/CROm0Qa:BA/izjr+/xRQ5d0Ce+rROm0Qa
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fff2bba9f36cc86a17164c6fc387cf1b_JaffaCakes118
Files
-
fff2bba9f36cc86a17164c6fc387cf1b_JaffaCakes118.exe windows:4 windows x86 arch:x86
b304202b8d50696e614cda5814dec5ca
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt
strchr
wcscpy
atoi
sprintf
strncpy
strrchr
_except_handler3
malloc
free
strncmp
__CxxFrameHandler
strstr
_ftol
ceil
memmove
_strnicmp
_strrev
_errno
exit
strncat
_CxxThrowException
_beginthreadex
calloc
??1type_info@@UAE@XZ
??3@YAXPAX@Z
??2@YAPAXI@Z
kernel32
OutputDebugStringA
GetCurrentThreadId
lstrcmpiA
Process32First
Process32Next
LocalSize
GetWindowsDirectoryA
ExitProcess
SetErrorMode
OpenEventA
ReleaseMutex
GetSystemInfo
GlobalMemoryStatusEx
WaitForMultipleObjects
PeekNamedPipe
TerminateProcess
DisconnectNamedPipe
GetStartupInfoA
GetSystemDirectoryA
GlobalSize
GlobalAlloc
GlobalFree
InitializeCriticalSection
DeleteCriticalSection
VirtualFree
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
CreateEventA
CloseHandle
WaitForSingleObject
ResetEvent
lstrcpyA
SetEvent
InterlockedExchange
CancelIo
Sleep
DeleteFileA
GetLastError
CreateDirectoryA
GetFileAttributesA
lstrlenA
CreateProcessA
lstrcatA
GetDriveTypeA
GetDiskFreeSpaceExA
GetVolumeInformationA
GetLogicalDriveStringsA
FindClose
LocalFree
FindNextFileA
LocalReAlloc
FindFirstFileA
LocalAlloc
RemoveDirectoryA
GetFileSize
CreateFileA
ReadFile
SetFilePointer
WriteFile
MoveFileA
GetProcAddress
LoadLibraryA
GetVersionExA
GetCurrentProcess
FreeLibrary
OpenProcess
MultiByteToWideChar
CreateThread
TerminateThread
GetTickCount
WinExec
RaiseException
GetModuleFileNameA
ws2_32
WSAGetLastError
gethostname
inet_addr
inet_ntoa
select
__WSAFDIsSet
recv
ntohs
socket
gethostbyname
htons
connect
setsockopt
recvfrom
sendto
listen
accept
getpeername
bind
closesocket
getsockname
WSAStartup
WSACleanup
WSAIoctl
send
msvcp60
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Xran@std@@YAXXZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
msvfw32
ICCompressorFree
ICClose
ICOpen
ICSendMessage
ICSeqCompressFrameStart
ICSeqCompressFrame
ICSeqCompressFrameEnd
iphlpapi
GetIfTable
Sections
.text Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE Size: 4KB - Virtual size: 944B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 4KB - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 16B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ