Behavioral task
behavioral1
Sample
041dcd86b5ad0d8260f66e6673ee4fe2_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
041dcd86b5ad0d8260f66e6673ee4fe2_JaffaCakes118
-
Size
236KB
-
MD5
041dcd86b5ad0d8260f66e6673ee4fe2
-
SHA1
587a06b760fc0afd3b6c30eb4303f65f97611870
-
SHA256
4d8b322c5dc96d84b07f58301b54c397fa81a923ca3aa60846927d108a017638
-
SHA512
6e78daf2879e3c1e23900ceaf04407e0d01ad8ae3221c86313a8ebdc364d0b8f80a904bd8fce85103bccbcb0d8aa0414d1bca986cbe6afa5187928c4e90e85aa
-
SSDEEP
3072:QQTeTY1Em5WBqwP3fsRQ/Xz7iastKyC/hX6Ixv34ntmefwd5S1UcMLHt:liTViWB0uL7thJ5Jp34tYCCcM5
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 041dcd86b5ad0d8260f66e6673ee4fe2_JaffaCakes118
Files
-
041dcd86b5ad0d8260f66e6673ee4fe2_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 136KB - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 28KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.jiao Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.jia Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.fao Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.zwt Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.. Size: 24KB - Virtual size: 24KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE