gh0strat | 2ae81302ee475219b0bcf0f177bfae7e_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

2ae81302ee475219b0bcf0f177bfae7e_JaffaCakes118
Size

161KB
MD5

2ae81302ee475219b0bcf0f177bfae7e
SHA1

bde982905bc4097ca1967745de139431e716178b
SHA256

fd11c90894e9f9461ddb3071c62cbcd471b74a521f8bc3043618d95b17bec004
SHA512

eef45099093b0b845f2f798bafd22ae51a7d6769e99e956ca588114ad13c3eac6e14ffd43179d83a919827f6bc1591fae1bb458ee9a4319b57d31407269a59ef
SSDEEP

3072:NrRisP8ID+i7iJVXzB1aJX4e+LA+cX4ph04aBEQojH47Regpl2lSzU:8i+JVDqBzMA+o4ph04aBEQo7sR7ltz

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2ae81302ee475219b0bcf0f177bfae7e_JaffaCakes118

Files

2ae81302ee475219b0bcf0f177bfae7e_JaffaCakes118
.exe windows:4 windows x86 arch:x86

483b635a76ccebd2763596fc407bbe4e

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

GetLocalTime
GetCurrentProcessId
HeapAlloc
GetProcessHeap
DeleteFileA
CreateDirectoryA
GetFileAttributesA
lstrcpyA
lstrlenA
GetDriveTypeA
GetDiskFreeSpaceExA
GetVolumeInformationA
GetLogicalDriveStringsA
FindClose
LocalFree
FindNextFileA
LocalReAlloc
FindFirstFileA
LocalAlloc
GetFileSize
ReadFile
SetFilePointer
MoveFileA
lstrcatA
CreateProcessA
ExitProcess
WinExec
WriteFile
CreateFileA
GetModuleFileNameA
Process32Next
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
HeapFree
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
GetModuleHandleA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GetStartupInfoA
WaitForMultipleObjects
LocalSize
TerminateProcess
OpenProcess
GetCurrentThreadId
GlobalMemoryStatus
GetSystemInfo
GetComputerNameA
GetTickCount
OpenEventA
SetErrorMode
OutputDebugStringA
CreateMutexA
GetCurrentProcess
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetEnvironmentVariableA
GetShortPathNameA
CopyFileA
LCMapStringW
LCMapStringA
SetStdHandle
FlushFileBuffers
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
InterlockedIncrement
InterlockedDecrement
IsBadCodePtr
IsBadReadPtr
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
WideCharToMultiByte
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapSize
IsBadWritePtr
HeapReAlloc
HeapCreate
HeapDestroy
SetUnhandledExceptionFilter
InitializeCriticalSection
CancelIo
InterlockedExchange
ResetEvent
GetLastError
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
CreateThread
ResumeThread
SetEvent
WaitForSingleObject
Sleep
TerminateThread
CloseHandle
FreeLibrary
LoadLibraryA
GetVersionExA
GetProcAddress
SetLastError
TlsAlloc
GetVersion
GetCommandLineA
ExitThread
TlsGetValue
TlsSetValue
RaiseException
RtlUnwind

user32

TranslateMessage
GetMessageA
CharNextA
wsprintfA
GetWindowTextA
MessageBoxA
LoadCursorA
DispatchMessageA
SendMessageA
keybd_event
MapVirtualKeyA
SetCapture
WindowFromPoint
SetCursorPos
mouse_event
CloseClipboard
BlockInput
GetWindowThreadProcessId
CloseWindow
IsWindow
PostMessageA
OpenDesktopA
GetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
SetThreadDesktop
CloseDesktop
IsWindowVisible
GetDesktopWindow
ExitWindowsEx
GetCursorPos
GetCursorInfo
DestroyCursor
ReleaseDC
GetDC
SetRect
GetSystemMetrics
GetClipboardData
OpenClipboard
EmptyClipboard
SetClipboardData

advapi32

LookupPrivilegeValueA
AdjustTokenPrivileges
RegOpenKeyA
InitializeSecurityDescriptor
AllocateAndInitializeSid
GetLengthSid
InitializeAcl
AddAccessAllowedAce
SetSecurityDescriptorDacl
FreeSid
RegCreateKeyExA
RegSetValueExA
OpenEventLogA
ClearEventLogA
CloseEventLog
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
OpenProcessToken

shell32

SHGetSpecialFolderPathA

ws2_32

WSAStartup
WSACleanup
WSAIoctl
setsockopt
htons
gethostbyname
socket
select
getsockname
htonl
WSASocketA
sendto
connect
inet_addr
send
closesocket
recv

Sections

.text
Size: 113KB - Virtual size: 113KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 31KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data
.rdata
.rsrc/BITMAP/103.bmp
.rsrc/MANIFEST/1
.xml
.rsrc/MENU/102
.rsrc/version.txt
.text

Sharing

General

Malware Config

Signatures

Files

483b635a76ccebd2763596fc407bbe4e

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

ws2_32

Sections

.text Size: 113KB - Virtual size: 113KB

.rdata Size: 13KB - Virtual size: 13KB

.data Size: 31KB - Virtual size: 39KB

.rsrc Size: 2KB - Virtual size: 1KB

.text
Size: 113KB - Virtual size: 113KB

.rdata
Size: 13KB - Virtual size: 13KB

.data
Size: 31KB - Virtual size: 39KB

.rsrc
Size: 2KB - Virtual size: 1KB