gh0strat | 86ccbf4e6e1b1ae5699332378e4eeec4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

86ccbf4e6e1b1ae5699332378e4eeec4_JaffaCakes118
Size

185KB
MD5

86ccbf4e6e1b1ae5699332378e4eeec4
SHA1

17bf50c25d96c4b94a1a0bb11b241e41bd8f8bf4
SHA256

899b9111e66de495f311164a9d8a0629c0da6c407beea86283afab5034126d60
SHA512

aa3eb49e50517bb782683a535e53962aee75c81bd7f533a566a8f4e3f0bb5368e1ebe39b2a8cd28656fcde5ee63c2bafed1bd1e9e87329e21edbd08567fb06df
SSDEEP

3072:hpuSiB6amg61TZs+vPgML3qP793d2JmtTBftlRKdcUAV:DuSC1mgoTaLiY9t2JmtTBLRZUAV

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
86ccbf4e6e1b1ae5699332378e4eeec4_JaffaCakes118

Files

86ccbf4e6e1b1ae5699332378e4eeec4_JaffaCakes118
.dll windows:4 windows x86 arch:x86

493700bdeb8f47a722609762b0c3b2ad

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GlobalAlloc
GlobalSize
CreatePipe
DisconnectNamedPipe
PeekNamedPipe
WaitForMultipleObjects
GlobalMemoryStatusEx
GetModuleHandleA
GetModuleHandleW
GetSystemInfo
CreateMutexA
OutputDebugStringA
OpenEventA
ExitProcess
GetStartupInfoA
SetFileAttributesA
WinExec
lstrcmpiA
Module32Next
Module32First
CreateRemoteThread
OpenProcess
GlobalMemoryStatus
GetComputerNameA
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
GetCurrentThreadId
GetModuleFileNameA
Process32First
Process32Next
GetProcessHeap
CreateToolhelp32Snapshot
LocalSize
GlobalLock
MoveFileA
WriteFile
SetFilePointer
ReadFile
CreateFileA
GetFileSize
RemoveDirectoryA
LocalAlloc
FindFirstFileA
LocalReAlloc
FindNextFileA
LocalFree
FindClose
GetLogicalDriveStringsA
GetVolumeInformationA
GetDiskFreeSpaceExA
GetDriveTypeA
GetFileAttributesA
CreateDirectoryA
GetLastError
DeleteFileA
GetVersionExA
GetPrivateProfileStringA
lstrcmpA
WideCharToMultiByte
MultiByteToWideChar
GetWindowsDirectoryA
GetPrivateProfileSectionNamesA
lstrlenA
CreateProcessA
TerminateProcess
GetSystemDirectoryA
lstrcatA
GetProcAddress
lstrcpyA
GlobalUnlock
GlobalFree
HeapAlloc
GetLocalTime
GetCurrentProcess
GetTempPathA
MoveFileExA
HeapFree
TerminateThread
FreeLibrary
CreateThread
ExitThread
GetTickCount
ResetEvent
CancelIo
InterlockedExchange
SetEvent
Sleep
CloseHandle
CreateEventA
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
InitializeCriticalSection
WaitForSingleObject
LoadLibraryA
CopyFileA

user32

WindowFromPoint
SetCursorPos
mouse_event
LoadCursorA
SetClipboardData
EmptyClipboard
OpenClipboard
GetClipboardData
GetSystemMetrics
SetRect
SystemParametersInfoA
SetCapture
ReleaseDC
GetCursorInfo
BlockInput
GetKeyState
GetAsyncKeyState
GetForegroundWindow
ExitWindowsEx
EnumWindows
GetWindowTextA
CharNextA
wsprintfA
MapVirtualKeyA
keybd_event
GetDesktopWindow
SendMessageA
GetDC
DestroyCursor
CreateWindowExA
IsWindow
CloseClipboard
OpenDesktopA
GetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
SetThreadDesktop
CloseDesktop
ShowWindow
PostMessageA
IsWindowVisible
GetWindowThreadProcessId
GetCursorPos

gdi32

GetDIBits
BitBlt
DeleteDC
DeleteObject
CreateCompatibleDC
CreateDIBSection
SelectObject
CreateCompatibleBitmap

advapi32

RegOpenKeyA
RegQueryValueExA
RegCreateKeyA
RegSetValueExA
OpenSCManagerA
OpenServiceA
QueryServiceStatus
ControlService
DeleteService
CloseServiceHandle
RegOpenKeyExA
RegQueryValueA
RegCloseKey
LsaFreeMemory
LsaOpenPolicy
LsaRetrievePrivateData
LsaClose
LookupAccountNameA
IsValidSid
ChangeServiceConfig2A
StartServiceA
CreateServiceA
CloseEventLog
ClearEventLogA
OpenEventLogA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegEnumValueA
RegEnumKeyExA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegQueryInfoKeyA
CreateProcessAsUserA
SetTokenInformation
DuplicateTokenEx
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
UnlockServiceDatabase
LockServiceDatabase
AbortSystemShutdownA
GetUserNameA
LookupAccountSidA
GetTokenInformation
ChangeServiceConfigA
QueryServiceConfigA
EnumServicesStatusA

shell32

SHGetFileInfoA
SHGetSpecialFolderPathA
ShellExecuteA

ole32

CoUninitialize
CoCreateInstance
CoInitialize

oleaut32

SysFreeString

msvcrt

_mkdir
_beginthreadex
_strnicmp
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
_snprintf
_strcmpi
_strupr
_mbscmp
_mbsstr
wcscpy
wcstombs
wcslen
mbstowcs
_errno
strncmp
atol
realloc
strncat
exit
_iob
strrchr
_except_handler3
free
malloc
time
srand
strchr
sprintf
strcspn
strncpy
atoi
rand
strstr
_ftol
ceil
memmove
_CxxThrowException
??2@YAPAXI@Z
??3@YAXPAX@Z
__CxxFrameHandler

winmm

waveInGetNumDevs

ws2_32

getsockname
getpeername
listen
inet_ntoa
accept
WSAGetLastError
bind
WSAStartup
WSACleanup
recvfrom
__WSAFDIsSet
ioctlsocket
gethostname
WSASocketA
htonl
sendto
inet_addr
socket
gethostbyname
htons
connect
select
recv
send
closesocket
setsockopt
WSAIoctl
ntohs

msvcp60

?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Xran@std@@YAXXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

iphlpapi

GetIfTable

urlmon

URLDownloadToFileA

wininet

InternetOpenUrlA
InternetReadFile
InternetCloseHandle
InternetOpenA

msvfw32

ICSeqCompressFrame
ICSeqCompressFrameEnd
ICSeqCompressFrameStart
ICSendMessage
ICOpen
ICClose
ICCompressorFree

wtsapi32

WTSEnumerateSessionsA
WTSFreeMemory
WTSQuerySessionInformationA
WTSDisconnectSession
WTSLogoffSession

netapi32

NetUserDel
NetUserSetInfo
NetUserGetLocalGroups
NetApiBufferFree
NetUserGetInfo
NetUserEnum
NetLocalGroupAddMembers
NetUserAdd

psapi

GetModuleFileNameExA
EnumProcessModules

Exports

Exports

DllFuUpgradrs
DllFuUpgradrs1

Sections

.text
Size: 131KB - Virtual size: 131KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

493700bdeb8f47a722609762b0c3b2ad

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

msvcrt

winmm

ws2_32

msvcp60

iphlpapi

urlmon

wininet

msvfw32

wtsapi32

netapi32

psapi

Exports

Exports

Sections

.text Size: 131KB - Virtual size: 131KB

.rdata Size: 29KB - Virtual size: 29KB

.data Size: 13KB - Virtual size: 33KB

.reloc Size: 10KB - Virtual size: 9KB

.text
Size: 131KB - Virtual size: 131KB

.rdata
Size: 29KB - Virtual size: 29KB

.data
Size: 13KB - Virtual size: 33KB

.reloc
Size: 10KB - Virtual size: 9KB