Behavioral task
behavioral1
Sample
00a62d22e0d2bc1191c7cf03303a9b96_JaffaCakes118.exe
Resource
win7-20240221-en
General
-
Target
00a62d22e0d2bc1191c7cf03303a9b96_JaffaCakes118
-
Size
126KB
-
MD5
00a62d22e0d2bc1191c7cf03303a9b96
-
SHA1
9b228c28e6e571463708eb41cc8127fb1a063114
-
SHA256
3f046e995d4b615b9ed5cd52372529f54972d7da0dcfbd136c4bd3ff3380fb97
-
SHA512
cb2ca473925e9bc8a0cad27307fec80444cab874d87dd35b25fe28a2035c6f7299daa75e36695b2cab3744bc2a39df0e524123551527764f575c4acb8368d038
-
SSDEEP
3072:1fu81m+O6rM/TWeHiYzmhLTIhttHU4o4ugkCiHWwxA:1f/1TMvCYkLTIT64N1kJ2W
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 00a62d22e0d2bc1191c7cf03303a9b96_JaffaCakes118
Files
-
00a62d22e0d2bc1191c7cf03303a9b96_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 340B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 119KB - Virtual size: 119KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ