Behavioral task
behavioral1
Sample
0651c868f104d18ff10fd43020af5806_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
0651c868f104d18ff10fd43020af5806_JaffaCakes118
-
Size
323KB
-
MD5
0651c868f104d18ff10fd43020af5806
-
SHA1
97f7c50e2b45e0abfcaa6611b90b40680eefb96e
-
SHA256
561669797e702da3bab69187f936c066c509ce25cbb18522f3a8b1968f96e195
-
SHA512
d1ff2c3cd73932dcd1b254dbd2d7e1d1247dbf770e24d7e5f8395332c92d6aca81fd40227dc96092c299270cac480d7e10b92ed20436549b283bdeeb5f731fdf
-
SSDEEP
6144:/iqvdXj9wTcEMJdllGNp2cEZg4gsbexrS9j0YKTsRKOxJziAiBoQrRTarNu4:/igdXBwIl7skExrE0Qri7oQrxyu4
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0651c868f104d18ff10fd43020af5806_JaffaCakes118
Files
-
0651c868f104d18ff10fd43020af5806_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.textbss Size: - Virtual size: 120KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.text Size: 3KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 317KB - Virtual size: 320KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.idata Size: 383B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ