212f9b21fdba617ac9064743c4f4241d_JaffaCakes118
- SHA256 23fd8379f9520fd1be46f4068819fe3d2e2bc1b304080842740b5a61b836fbc5
Behavioral task
behavioral1
Sample
ARP联盟.url
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
ARP联盟.url
Resource
win10v2004-20240419-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Chixue.exe
Resource
win7-20240221-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral4
Sample
Chixue.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
DNF赤血.exe
Resource
win7-20240419-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
DNF赤血.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
使用说明.url
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
使用说明.url
Resource
win10v2004-20240419-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target 212f9b21fdba617ac9064743c4f4241d_JaffaCakes118
- Size 950KB
- Sample240507-v1zyvaaf87
- SHA256 23fd8379f9520fd1be46f4068819fe3d2e2bc1b304080842740b5a61b836fbc5
- MD5 212f9b21fdba617ac9064743c4f4241d
- SHA1 7c8cd9fd9ca51a0755ee7e5fbd2ae601157a03dd
- SHA512 7d00a4ce657742d80082e0cb4e660cfa6c7ecb606b8830ece4eef06606dd175ba2b0668d9ee7ba25bf1c4511d5932c4dc411f293e546a6b6ea54dc3a88957d83
- SSDEEP 24576:1uUlAc0Uf7003aLDAY7TexV2DNBfTHV10LGJIDP:4rcoA20V2ZVTV1Uz
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Gh0st RAT payload 1 IoCs
resource yara_rule static1/unpack001/DNF赤血.exe family_gh0strat - Gh0strat family
-
resource yara_rule static1/unpack001/Chixue.dll upx - Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Chixue.dll unpack001/DNF赤血.exe
File Explorer
-
212f9b21fdba617ac9064743c4f4241d_JaffaCakes118.rar 950KB
-
ARP联盟.url320B
-
Chixue.dll.exe 357KB
-
DNF赤血.exe.exe 701KB
-
使用说明.url76B
ARP联盟.url
- SHA256 7448cecf8fb2e15c71143edeb24bbf4103c9bc8e762f49ec1a8baa283876fec5
- MD5 6a22d9b6c47c5a438720b6129ba2d951
- SHA1 616f2c48275b625c661da0181a0b59bba86786b7
- SHA512 e8cba993202397e0eb8d70406154dfe84b4eee50b452fde7af7e536aaabfa307981b83b6f04131a73b1801419b969f3f282f8a0bc06f91beb625f26f4caf2d52
- MD5 SHA1 SHA512
Chixue.dll
- SHA256 affc70f6d5dec295d22c3835e1d9dff0b4275c4a36575c56cb6421a1e6ad8d8e
- MD5 22b47f0aa933fc90b5fa308eb539c687
- SHA1 22f3b24d4c4a654a84466cb2076971119a6a7bf3
- SHA512 cbaf06070ca162c73ae2b8535575a62471f520439f5f29a107c3978b5a366e9fb96816772539498d45df1698c4b6bc0ffe870d39a98724d294c70374557007b8
- SSDEEP 6144:/h19E+P0B1cR8uehKZIi70ggKY4SK+KPnqSNFDNyTyC3w0hM5PCjXdqL3gdYw5bH:lEi0BaR8ucyIiy/56/NFwyehMUjXyIoS
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
565872
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
Name
UPX0
Size
Virtual Size
204KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
348KB
Virtual Size
348KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
9KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
DNF赤血.exe
- IMPHASH 9165ea3e914e03bda3346f13edbd6ccd
- SHA256 e237efbae1f63cd4f50966ad1c7e7dce6a029b327e28d075871f21965aaf7b6a
- MD5 929c80dfd2eebba079dcc1bf728fbc18
- SHA1 d83eef62568f2aed147cc46f3686ea0667fece50
- SHA512 17cc81155f29691cf121f60975f444b7419e0c9c035f8cef5e834eb23e6a828857bcae551297b24fc0f25b7c229867a4f50b38837f7a8b81940b33f3439c3683
- SSDEEP 12288:AvvigjAEVexb2LkEp3gos8uXY4cO/gqhd+3C5+qQUjJUU4QdxIYDdtWnI+NKnw/Z:Avv5AEVkbMkEp3W8AD/Dhd+y4lqJ8Qd4
- MD5 SHA1 SHA512 SSDEEP
-
Gh0st RAT payload
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14385
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
PDB paths
kernel32
GetProcAddress
LoadLibraryA
CloseHandle
WriteFile
CreateDirectoryA
GetTempPathA
ReadFile
SetFilePointer
CreateFileA
GetModuleFileNameA
GetStringTypeA
LCMapStringW
LCMapStringA
HeapAlloc
HeapFree
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
ExitProcess
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
RtlUnwind
GetCPInfo
GetACP
GetOEMCP
MultiByteToWideChar
GetStringTypeW
user32
MessageBoxA
wsprintfA
Name
.text
Size
20KB
Virtual Size
19KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
8KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.ecode
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
4KB
Virtual Size
928B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
使用说明.url
- SHA256 71c764d56a08a19798ba965bb342a79ed0f188f14552fdc1a37fb2c39e38477f
- MD5 440fc8a8db3d635721fbc68ca8ac650e
- SHA1 729641b59dad4d0b91fe341a31cf6117c8f05041
- SHA512 3eaf600c2d5b5e50de0ddcae3a0074ca80209ecc75c72e54f990860184f185adec3892ceff2f5a0144c807322bbeca478a8666e0ca2a0e2512e3e91833a6b831
- MD5 SHA1 SHA512