General

  • Target

    085f5340e78927165d4a997dd88d0ab1_JaffaCakes118

  • Size

    417KB

  • Sample

    240429-xf3v4shh35

  • MD5

    085f5340e78927165d4a997dd88d0ab1

  • SHA1

    f9926a66d4594186e469d3d160b6df723357cd85

  • SHA256

    8c116f7a4dc6e9e471c46d98198dc6365e235b41c1c0ab612d6ee991a71c6d0e

  • SHA512

    71eafbaf33e1d4c28043b124510be0ea8fb9c53e8f60737e55ff6a2158ac1631202f98a29c8b2492dcd308b2210f3366c9152f2d720ce8ea13eb3c8bacaa51de

  • SSDEEP

    6144:QGzRxSVtp0l6whGfsKR+zkBpTaa5tJHXB:jt0VPFfsKAkrbPlXB

Malware Config

Targets

    • Target

      085f5340e78927165d4a997dd88d0ab1_JaffaCakes118

    • Size

      417KB

    • MD5

      085f5340e78927165d4a997dd88d0ab1

    • SHA1

      f9926a66d4594186e469d3d160b6df723357cd85

    • SHA256

      8c116f7a4dc6e9e471c46d98198dc6365e235b41c1c0ab612d6ee991a71c6d0e

    • SHA512

      71eafbaf33e1d4c28043b124510be0ea8fb9c53e8f60737e55ff6a2158ac1631202f98a29c8b2492dcd308b2210f3366c9152f2d720ce8ea13eb3c8bacaa51de

    • SSDEEP

      6144:QGzRxSVtp0l6whGfsKR+zkBpTaa5tJHXB:jt0VPFfsKAkrbPlXB

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks