gh0strat | 033f2173f21e7670a4a438a86b0a2cce_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
033f2173f21e7670a4a438a86b0a2cce_JaffaCakes118
Size 688KB
Sample240427-pmsdysae52
SHA256 8d70971460676b3cf2e6b63386b4ebae2b3c7f0f102ce8b6a63075fb3739903d
MD5 033f2173f21e7670a4a438a86b0a2cce
SHA1 7847c7834ba2d4f9b84cbfc2aef49ec1d15f0c92
SHA512 3788c3c10f14837a9d8790f78d2091ed6bb7dfbae2e075d1b8430b7dd23e4918623d20e51586212151f7a23de8df11d2015b21a0a8632ee9fa33ef8c9b7d23c4
SSDEEP 6144:u4kr0hGz6H8OLAQ36Qx+rHXNVtGnvY7BXd:ur0g6hLAQ36S+ZCvgBXd
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
033f2173f21e7670a4a438a86b0a2cce_JaffaCakes118

File Explorer

033f2173f21e7670a4a438a86b0a2cce_JaffaCakes118

.exe 688KB

033f2173f21e7670a4a438a86b0a2cce_JaffaCakes118

IMPHASH c1d52839c45a99a4ff2d4e09ea523349
SHA256 8d70971460676b3cf2e6b63386b4ebae2b3c7f0f102ce8b6a63075fb3739903d
MD5 033f2173f21e7670a4a438a86b0a2cce
SHA1 7847c7834ba2d4f9b84cbfc2aef49ec1d15f0c92
SHA512 3788c3c10f14837a9d8790f78d2091ed6bb7dfbae2e075d1b8430b7dd23e4918623d20e51586212151f7a23de8df11d2015b21a0a8632ee9fa33ef8c9b7d23c4
SSDEEP 6144:u4kr0hGz6H8OLAQ36Qx+rHXNVtGnvY7BXd:ur0g6hLAQ36S+ZCvgBXd
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Gh0st RAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

94614

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

shlwapi

SHDeleteKeyA

msvcrt

_controlfp __set_app_type __p__fmode __p__commode _adjust_fdiv __setusermatherr _initterm __getmainargs _acmdln _XcptFilter _exit _onexit __dllonexit calloc _beginthreadex sprintf realloc strncat exit rand _errno strncmp strchr atoi wcscpy strncpy strrchr _except_handler3 malloc free ??2@YAPAXI@Z __CxxFrameHandler strstr _ftol ceil memmove ??3@YAXPAX@Z _strnicmp _strcmpi

ws2_32

connect setsockopt WSAIoctl WSACleanup WSAStartup htons select send inet_ntoa inet_addr getsockname gethostbyname socket recv ntohs closesocket bind getpeername accept listen sendto recvfrom __WSAFDIsSet gethostname WSAGetLastError

msvcp60

?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?_Xran@std@@YAXXZ ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z

mfc42

ord755 ord470 ord2379 ord4274 ord6375 ord4486 ord2554 ord2512 ord5731 ord3922 ord1089 ord5199 ord2396 ord3346 ord5300 ord5302 ord2725 ord4079 ord4698 ord5307 ord5289 ord5714 ord4622 ord4424 ord3738 ord561 ord815 ord2621 ord1134 ord2863 ord540 ord4160 ord800 ord1168 ord1146 ord4234 ord641 ord324 ord3597 ord4425 ord4627 ord4080 ord3079 ord3825 ord3831 ord3830 ord2976 ord3081 ord2985 ord3262 ord5265 ord3136 ord4465 ord3259 ord3147 ord2982 ord5277 ord2124 ord2446 ord5261 ord1727 ord5065 ord3749 ord6376 ord2055 ord2648 ord4441 ord4837 ord3798 ord5280 ord4353 ord6374 ord5163 ord2385 ord5241 ord4407 ord1775 ord4078 ord6052 ord2514 ord4710 ord4998 ord4853 ord4376 ord4673

kernel32

PeekNamedPipe WaitForMultipleObjects GlobalMemoryStatus GetSystemInfo GetVersionExA ReleaseMutex SetErrorMode GetLocalTime lstrcmpA ExitProcess LocalSize Process32Next Process32First CreateToolhelp32Snapshot lstrcmpiA GetCurrentThreadId GetModuleHandleA OpenEventA TerminateProcess DisconnectNamedPipe CreatePipe GetStartupInfoA GetSystemDirectoryA GlobalSize GlobalAlloc GlobalLock GlobalUnlock GlobalFree GetProcessHeap HeapAlloc HeapFree GetModuleFileNameA OutputDebugStringA WinExec GetTickCount TerminateThread CreateThread MultiByteToWideChar OpenProcess FreeLibrary VirtualAllocEx CreateRemoteThread GetCurrentProcess SetLastError LoadLibraryA GetProcAddress MoveFileA WriteFile SetFilePointer ReadFile CreateFileA GetFileSize RemoveDirectoryA LocalAlloc FindFirstFileA LocalReAlloc FindNextFileA LocalFree FindClose GetLogicalDriveStringsA GetVolumeInformationA GetDiskFreeSpaceExA GetDriveTypeA CreateProcessA lstrlenA GetFileAttributesA CreateDirectoryA GetLastError DeleteFileA Sleep CancelIo InterlockedExchange SetEvent lstrcpyA ResetEvent WaitForSingleObject CloseHandle CreateEventA VirtualAlloc EnterCriticalSection LeaveCriticalSection VirtualFree DeleteCriticalSection InitializeCriticalSection lstrcatA

user32

CloseWindow IsWindow EnableWindow LoadIconA AppendMenuA GetSystemMenu DrawIcon GetClientRect IsIconic GetCursorPos GetCursorInfo ReleaseDC GetDesktopWindow GetDC CreateWindowExA GetSystemMetrics GetClipboardData SetClipboardData CloseClipboard mouse_event SetCursorPos WindowFromPoint SetCapture MapVirtualKeyA SendMessageA SystemParametersInfoA DestroyCursor LoadCursorA wsprintfA CharNextA PostMessageA OpenDesktopA SetProcessWindowStation GetThreadDesktop GetUserObjectInformationA OpenInputDesktop SetThreadDesktop CloseDesktop EnumWindows GetWindowTextA IsWindowVisible GetWindowThreadProcessId ExitWindowsEx GetProcessWindowStation OpenWindowStationA SetRect

gdi32

CreateCompatibleBitmap GetDIBits BitBlt DeleteDC DeleteObject CreateCompatibleDC CreateDIBSection SelectObject

advapi32

GetNamedSecurityInfoA RegDeleteValueA RegDeleteKeyA CreateServiceA LookupAccountSidA GetTokenInformation RegEnumValueA AllocateAndInitializeSid RegCloseKey RegQueryValueA RegOpenKeyExA CloseServiceHandle DeleteService ControlService QueryServiceStatus OpenServiceA RegSetValueExA RegCreateKeyA SetNamedSecurityInfoA BuildExplicitAccessWithNameA SetEntriesInAclA RegQueryValueExA RegOpenKeyA RegCreateKeyExA CloseEventLog ClearEventLogA OpenEventLogA LookupPrivilegeValueA OpenProcessToken FreeSid RegSetKeySecurity SetSecurityDescriptorDacl GetLengthSid InitializeSecurityDescriptor AddAccessAllowedAce InitializeAcl RegEnumKeyExA

shell32

SHGetSpecialFolderPathA SHGetFileInfoA

netapi32

NetUserAdd NetLocalGroupAddMembers

wininet

InternetOpenUrlA InternetOpenA InternetReadFile InternetCloseHandle

msvfw32

ICSeqCompressFrameStart ICSeqCompressFrameEnd ICCompressorFree ICClose ICOpen ICSendMessage ICSeqCompressFrame

iphlpapi

GetIfTable

wtsapi32

WTSQuerySessionInformationA WTSFreeMemory

Name

.text

Size

108KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

12KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

536KB

Virtual Size

532KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

033f2173f21e7670a4a438a86b0a2cce_JaffaCakes118

shlwapi

msvcrt

ws2_32

msvcp60

mfc42

kernel32

user32

gdi32

advapi32

shell32

netapi32

wininet

msvfw32

iphlpapi

wtsapi32

generic