Behavioral task
behavioral1
Sample
028e2ee9814be7c71d212c7ca6dd2431_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
028e2ee9814be7c71d212c7ca6dd2431_JaffaCakes118.exe
Resource
win10v2004-20240611-en
General
-
Target
028e2ee9814be7c71d212c7ca6dd2431_JaffaCakes118
-
Size
167KB
-
MD5
028e2ee9814be7c71d212c7ca6dd2431
-
SHA1
9e542daa0a9bc0b7343ba8189be319e4fe2bf159
-
SHA256
2c8150d8b64804c7fd6a6e25782a21c98b4ac0add9dcb033da5b00920e78a92c
-
SHA512
3c1a086e5c1ad1009617959a898a42b5af379eb9930c6235294401f9bfa4417b4321cc23a88eac6c9b5da5134e2490be5d1e1f27d37190965374b148e163b150
-
SSDEEP
3072:/aOxrC/pn3ANIQhMfcTvbttBAUwUzbIIIwkGfe:SOA/pnI5tKfYbIIIwkGm
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 028e2ee9814be7c71d212c7ca6dd2431_JaffaCakes118
Files
-
028e2ee9814be7c71d212c7ca6dd2431_JaffaCakes118.exe windows:4 windows x86 arch:x86
16c548bb48603877742580209b398e17
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
FreeLibrary
GetProcAddress
LoadLibraryA
GetLastError
CreateToolhelp32Snapshot
GetModuleHandleA
CreateFileA
Sleep
GetTickCount
ExitProcess
lstrcmpiA
WideCharToMultiByte
MultiByteToWideChar
HeapFree
HeapAlloc
GetProcessHeap
DeleteFileA
MoveFileA
CloseHandle
lstrlenA
SetFileTime
LocalFileTimeToFileTime
FindFirstFileA
lstrcatA
ReadFile
SetFilePointer
WaitForSingleObject
CopyFileA
lstrcpyA
WritePrivateProfileStringA
GetTempPathA
CreateDirectoryA
GetFileAttributesA
ReleaseMutex
CreateMutexA
GetCommandLineA
RaiseException
InterlockedExchange
LocalAlloc
GetStartupInfoA
msvcrt
rand
srand
time
strchr
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
strstr
??2@YAPAXI@Z
_except_handler3
??3@YAXPAX@Z
malloc
_strcmpi
netapi32
NetApiBufferFree
NetUserGetLocalGroups
Sections
.text Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 968B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 153KB - Virtual size: 153KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ