gh0strat | 2ae81302ee475219b0bcf0f177bfae7e_JaffaCakes118

resource	yara_rule
sample	family_gh0strat

resource
2ae81302ee475219b0bcf0f177bfae7e_JaffaCakes118

2ae81302ee475219b0bcf0f177bfae7e_JaffaCakes118

IMPHASH 483b635a76ccebd2763596fc407bbe4e
SHA256 fd11c90894e9f9461ddb3071c62cbcd471b74a521f8bc3043618d95b17bec004
MD5 2ae81302ee475219b0bcf0f177bfae7e
SHA1 bde982905bc4097ca1967745de139431e716178b
SHA512 eef45099093b0b845f2f798bafd22ae51a7d6769e99e956ca588114ad13c3eac6e14ffd43179d83a919827f6bc1591fae1bb458ee9a4319b57d31407269a59ef
SSDEEP 3072:NrRisP8ID+i7iJVXzB1aJX4e+LA+cX4ph04aBEQojH47Regpl2lSzU:8i+JVDqBzMA+o4ph04aBEQo7sR7ltz
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Gh0st RAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

82688

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLocalTime GetCurrentProcessId HeapAlloc GetProcessHeap DeleteFileA CreateDirectoryA GetFileAttributesA lstrcpyA lstrlenA GetDriveTypeA GetDiskFreeSpaceExA GetVolumeInformationA GetLogicalDriveStringsA FindClose LocalFree FindNextFileA LocalReAlloc FindFirstFileA LocalAlloc GetFileSize ReadFile SetFilePointer MoveFileA lstrcatA CreateProcessA ExitProcess WinExec WriteFile CreateFileA GetModuleFileNameA Process32Next lstrcmpiA Process32First CreateToolhelp32Snapshot HeapFree MapViewOfFile CreateFileMappingA UnmapViewOfFile GetModuleHandleA GlobalFree GlobalUnlock GlobalLock GlobalAlloc GlobalSize GetStartupInfoA WaitForMultipleObjects LocalSize TerminateProcess OpenProcess GetCurrentThreadId GlobalMemoryStatus GetSystemInfo GetComputerNameA GetTickCount OpenEventA SetErrorMode OutputDebugStringA CreateMutexA GetCurrentProcess SetThreadPriority GetCurrentThread SetPriorityClass GetEnvironmentVariableA GetShortPathNameA CopyFileA LCMapStringW LCMapStringA SetStdHandle FlushFileBuffers GetOEMCP GetACP GetCPInfo GetStringTypeW GetStringTypeA MultiByteToWideChar InterlockedIncrement InterlockedDecrement IsBadCodePtr IsBadReadPtr GetFileType GetStdHandle SetHandleCount GetEnvironmentStringsW GetEnvironmentStrings WideCharToMultiByte FreeEnvironmentStringsW FreeEnvironmentStringsA UnhandledExceptionFilter HeapSize IsBadWritePtr HeapReAlloc HeapCreate HeapDestroy SetUnhandledExceptionFilter InitializeCriticalSection CancelIo InterlockedExchange ResetEvent GetLastError VirtualAlloc EnterCriticalSection LeaveCriticalSection VirtualFree DeleteCriticalSection CreateThread ResumeThread SetEvent WaitForSingleObject Sleep TerminateThread CloseHandle FreeLibrary LoadLibraryA GetVersionExA GetProcAddress SetLastError TlsAlloc GetVersion GetCommandLineA ExitThread TlsGetValue TlsSetValue RaiseException RtlUnwind

user32

TranslateMessage GetMessageA CharNextA wsprintfA GetWindowTextA MessageBoxA LoadCursorA DispatchMessageA SendMessageA keybd_event MapVirtualKeyA SetCapture WindowFromPoint SetCursorPos mouse_event CloseClipboard BlockInput GetWindowThreadProcessId CloseWindow IsWindow PostMessageA OpenDesktopA GetThreadDesktop GetUserObjectInformationA OpenInputDesktop SetThreadDesktop CloseDesktop IsWindowVisible GetDesktopWindow ExitWindowsEx GetCursorPos GetCursorInfo DestroyCursor ReleaseDC GetDC SetRect GetSystemMetrics GetClipboardData OpenClipboard EmptyClipboard SetClipboardData

advapi32

LookupPrivilegeValueA AdjustTokenPrivileges RegOpenKeyA InitializeSecurityDescriptor AllocateAndInitializeSid GetLengthSid InitializeAcl AddAccessAllowedAce SetSecurityDescriptorDacl FreeSid RegCreateKeyExA RegSetValueExA OpenEventLogA ClearEventLogA CloseEventLog RegOpenKeyExA RegQueryValueExA RegCloseKey OpenProcessToken

shell32

SHGetSpecialFolderPathA

ws2_32

WSAStartup WSACleanup WSAIoctl setsockopt htons gethostbyname socket select getsockname htonl WSASocketA sendto connect inet_addr send closesocket recv

.data

SHA256 55112be2e03e6e13a35eeb118d048f79e74db83e657852a5705585262c43bfee
MD5 463bca28492c372a4999962b03057b68
SHA1 44b006123fbaae113414b1c4ad5ec765f092b2a8
SHA512 7c17ab71b35e223e07fcb7f16c97c937156af2f4bab59365febb0231693e4b88a0c8deb16cc51eb2c0853d21bcc4749d562dcd390c4c8bb7e372f3d505ea7fea
SSDEEP 384:nXhN+fztUmT6FleVKrSJrlQs1VZAn6Kczukn:nXh4xP6F41hDq1Uum
MD5 SHA1 SHA512 SSDEEP

Gh0st RAT payload

.rdata

SHA256 01bebe86e8700c126f2c572c875d7468f96b5ae706e483764925de971cd00a40
MD5 814eef5f103f4995fae7d055b8d65d73
SHA1 b7706aec0352d14089b22a05cbc4b1d6ad75ccf7
SHA512 9a28f2a8055d01e0d826f9c3db951f5c8a23c6d1088383a36d2e72cdddd3a27b51ebaba4aed64409b38e06658ed8b1672c19845a257f53f6d205fb62653421e6
SSDEEP 192:yghlq/6gEPRkRr6eud5o7ozzgloYCnufu3O4ojXYplUPdvqwasl:tki/M6eu5KoYVfu3O46XYplUPdvZ9l
MD5 SHA1 SHA512 SSDEEP

Gh0st RAT payload

.rsrc/BITMAP/103.bmp

SHA256 ffabc504465994a50fed3bea2e5020ed46567be59cfa1628de1bdea07f220d27
MD5 66c3de780d6f3b1e5cd6cdcb8939acfe
SHA1 eb6d71711fc980f631f15ed6e57ba05edc9b5442
SHA512 7ade82bea19cdcf100b56d97152aaf2fd92efa5b27ffbb3ce2c64f94ff6b7532b2bc55a351442f6aba92fed715741289deeb18ac56951b6390dad0a8ea70172e
MD5 SHA1 SHA512

Gh0st RAT payload

.rsrc/MANIFEST/1

SHA256 35b7d03732d6f5834ca165995ac2985880c2ac0c13b0d9c60a23edc9e0ae11e3
MD5 3094519c13cf5858434d62962a7658c1
SHA1 e86d3c8fd3cc71adc15e9b51ef5b30cc0921e275
SHA512 b2170898588303d5c858502fc12c8d8412b088bd1ed1b2d6242183db3e8e6c7de8f0c1480a292f481fae2b7ba189f16ceeb8ac63e8c2e9c79da0f1696fd37428
MD5 SHA1 SHA512

Gh0st RAT payload

.rsrc/MENU/102

SHA256 0717dfca923df0beca176f2cb47bdf066cd80d7365dac55184d1a6282bb81b26
MD5 00067feb6f81dcd6320fa75d91cc78f4
SHA1 c1cee2e3274e9de4b959a8d97448949a4a185d93
SHA512 6ad6503fcd3f5f1d1ba67dd81fe9107be3f8c572328565343ba77e6bf77093d3bd533b473db557fb0c2f899777e745894a59775ea126d2df8a69609987755687
MD5 SHA1 SHA512

Gh0st RAT payload

.rsrc/version.txt

SHA256 e39b064c13b18973ffc478a3cdb7e1ca094b423731c27c2534988968d0b2c26d
MD5 68772ec31a40e55733f01bc563100cc8
SHA1 230669bf557387381f4d04476d5483caf4302201
SHA512 610add46afcf8c296eb56dc8e47ba41f35949c2137fd53b843e680968ac67cd50bf2add516f755b2405f4573a2fd528f84763aab099220a193cb66087ce28ad5
MD5 SHA1 SHA512

Gh0st RAT payload

.text

SHA256 c6e22d9e8680e4ec4be7b4eed849d3f711440f7aeedaf1ec91a9b3c38af220e9
MD5 ec88d417aa17dc685d4deeb7a937bc6b
SHA1 250e6b5ba300078892a672bb92a849db2ebd3acb
SHA512 c468c0c75968ad7a4eace97bda5e228de8615b1854c46ec882f80d79621a0c3591d0212fc734f054bd72200d9b2d2d2844faadfaa26930174ff94631d99845cc
SSDEEP 3072:brRisP8ID+i7iJVXzB1aJX4e+LA+cX4ph04aBEQojH4:ii+JVDqBzMA+o4ph04aBEQo7
MD5 SHA1 SHA512 SSDEEP

Gh0st RAT payload

Sharing

General

Malware Config

Signatures

File Explorer