Extracted

• • Target

    b03889b9ebf63154d70c97cea89f13a5_JaffaCakes118

  • Size

    112KB

  • MD5

    b03889b9ebf63154d70c97cea89f13a5

  • SHA1

    51d2cef64e6db8029d2d206f6865ad07cf36ae76

  • SHA256

    7c6c3b4d687b1e46697b497df7821e1f47d82a68fdcdf3fde48f5b358b330771

  • SHA512

    a5bbc9d5d5cb426eb955f728dac15f2351897712f4f766a2e5fa0334e41ddbd3d7fd59d2046e283fe3353ad625f6410292c88c58e255ff3921a2729bba394166

  • SSDEEP

    1536:vqEA70HzLJksPEOajozLElnqiO29dJ/tHi:vXTLJkQ7zAV3NtC

  Score

  10^/10

  gh0stratrunningratpersistencerat

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • RunningRat

    RunningRat is a remote access trojan first seen in 2018.

    ratrunningrat

  • Sets DLL path for service in the registry

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Creates a Windows Service

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2