Overview

overview

10

Static

static

3

72bb10e6bc...18.exe

windows7-x64

10

72bb10e6bc...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    72bb10e6bc89abba6b92d8026bbdf681_JaffaCakes118

  • Size

    431KB

  • Sample

    240525-v5jsesca4t

  • MD5

    72bb10e6bc89abba6b92d8026bbdf681

  • SHA1

    9fed316956c7de6c705d1045b657cd68d58b1cd3

  • SHA256

    86798e6b7a8168e80bb276180f5cc6ccc21aa74c0b0af8fe2abfc053aab7555c

  • SHA512

    4715148e91af54aafeb035c950df050da3588e6908505f1634576291597945afcb0c3db958bbe4e4063587a581df03fd025204ebd8602b0e2937cb34355d0724

  • SSDEEP

    6144:h9aip6KVakpKvPkejAcCOrxsn6eUo8w8PSXVJR8m8V0h87rb28xbk9a+0:TakA6Orxsn6m98PSXVJRw7f

Score
10/10
gh0stratrat

Malware Config

Targets

    • Target

      72bb10e6bc89abba6b92d8026bbdf681_JaffaCakes118

    • Size

      431KB

    • MD5

      72bb10e6bc89abba6b92d8026bbdf681

    • SHA1

      9fed316956c7de6c705d1045b657cd68d58b1cd3

    • SHA256

      86798e6b7a8168e80bb276180f5cc6ccc21aa74c0b0af8fe2abfc053aab7555c

    • SHA512

      4715148e91af54aafeb035c950df050da3588e6908505f1634576291597945afcb0c3db958bbe4e4063587a581df03fd025204ebd8602b0e2937cb34355d0724

    • SSDEEP

      6144:h9aip6KVakpKvPkejAcCOrxsn6eUo8w8PSXVJR8m8V0h87rb28xbk9a+0:TakA6Orxsn6m98PSXVJRw7f

    Score
    10/10
    gh0stratrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks