Overview

overview

10

Static

static

10

6d1d0a91fa...18.exe

windows7-x64

10

6d1d0a91fa...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6d1d0a91faf8965575fc082b3d183698_JaffaCakes118

  • Size

    725KB

  • Sample

    240524-ddyzlaaf7v

  • MD5

    6d1d0a91faf8965575fc082b3d183698

  • SHA1

    6969d24d2314ffad5e0b242b55783e0864c54b88

  • SHA256

    f82fc5a5fade6c1dde10ced2747e88b1be7066f2aec8e7f012d7453e885c11b6

  • SHA512

    fcd6488d2917e68d4ac1d7004328e39a1019af9775589c74c8989425bf5e3ef920fee4f98636d8391232104e7d7a5a8835baa61b45cdc286335b8e7113bd266f

  • SSDEEP

    12288:iM5jZKbBL3aKHx5r+TuxX+fWbwFBfdGmZNv:iM5j8Z3aKHx5r+TuxX+IwffFZNv

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      6d1d0a91faf8965575fc082b3d183698_JaffaCakes118

    • Size

      725KB

    • MD5

      6d1d0a91faf8965575fc082b3d183698

    • SHA1

      6969d24d2314ffad5e0b242b55783e0864c54b88

    • SHA256

      f82fc5a5fade6c1dde10ced2747e88b1be7066f2aec8e7f012d7453e885c11b6

    • SHA512

      fcd6488d2917e68d4ac1d7004328e39a1019af9775589c74c8989425bf5e3ef920fee4f98636d8391232104e7d7a5a8835baa61b45cdc286335b8e7113bd266f

    • SSDEEP

      12288:iM5jZKbBL3aKHx5r+TuxX+fWbwFBfdGmZNv:iM5j8Z3aKHx5r+TuxX+IwffFZNv

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks