Overview

overview

10

Static

static

10

060c2b16cf...18.exe

windows7-x64

10

060c2b16cf...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    060c2b16cf5697dcbf3e9079dc00d173_JaffaCakes118

  • Size

    798KB

  • Sample

    240620-pveg3asapn

  • MD5

    060c2b16cf5697dcbf3e9079dc00d173

  • SHA1

    dc7ef8441a0415574cd45106f8ce8f83c1f4422b

  • SHA256

    525b5e7df58b44c90edf99785005370d33cf840e5a15ef9291d8491a3513bd56

  • SHA512

    981d984a145ffc9b0b6c4ccfdf6627fb4b6a14ef7eb3dd084c53b25b475b9bc5ebba20a5b65f4061ad1ccf2663891f9233f2676a2f4d4a38a82dbbb4c1786ef5

  • SSDEEP

    12288:iM5jZKbBL3aKHx5r+TuxX+fWbwFBfdGmZnR:iM5j8Z3aKHx5r+TuxX+IwffFZnR

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      060c2b16cf5697dcbf3e9079dc00d173_JaffaCakes118

    • Size

      798KB

    • MD5

      060c2b16cf5697dcbf3e9079dc00d173

    • SHA1

      dc7ef8441a0415574cd45106f8ce8f83c1f4422b

    • SHA256

      525b5e7df58b44c90edf99785005370d33cf840e5a15ef9291d8491a3513bd56

    • SHA512

      981d984a145ffc9b0b6c4ccfdf6627fb4b6a14ef7eb3dd084c53b25b475b9bc5ebba20a5b65f4061ad1ccf2663891f9233f2676a2f4d4a38a82dbbb4c1786ef5

    • SSDEEP

      12288:iM5jZKbBL3aKHx5r+TuxX+fWbwFBfdGmZnR:iM5j8Z3aKHx5r+TuxX+IwffFZnR

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks