General
-
Target
05824665fd612ece2d26104f3e267d64_JaffaCakes118
-
Size
61KB
-
Sample
240623-h1ayhatdrh
-
MD5
05824665fd612ece2d26104f3e267d64
-
SHA1
62044d622877857d7ddeecd6dd454dfe6ba4a580
-
SHA256
5d70af852ae589a8f4dbf1bb289400dc8c5b5017ad5bea4f7e734a8b831bc423
-
SHA512
02e676a7e00f0a929c6072bb086a40ae8f04c5f53acdb1ebc8437513fcac6ab38bbb724bbf4bcb62fde3b7b3969cf65c497925c75d280e2f5b9709b7a2dec85a
-
SSDEEP
1536:eGvxI12D/iZSaWPUqYMf7JiREeMX9+s3Um6oBHdh4IzOBDn4u:ekroSfaMfFiRU9+tkl9yBDnj
Static task
static1
Behavioral task
behavioral1
Sample
05824665fd612ece2d26104f3e267d64_JaffaCakes118.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
05824665fd612ece2d26104f3e267d64_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Malware Config
Targets
-
-
Target
05824665fd612ece2d26104f3e267d64_JaffaCakes118
-
Size
61KB
-
MD5
05824665fd612ece2d26104f3e267d64
-
SHA1
62044d622877857d7ddeecd6dd454dfe6ba4a580
-
SHA256
5d70af852ae589a8f4dbf1bb289400dc8c5b5017ad5bea4f7e734a8b831bc423
-
SHA512
02e676a7e00f0a929c6072bb086a40ae8f04c5f53acdb1ebc8437513fcac6ab38bbb724bbf4bcb62fde3b7b3969cf65c497925c75d280e2f5b9709b7a2dec85a
-
SSDEEP
1536:eGvxI12D/iZSaWPUqYMf7JiREeMX9+s3Um6oBHdh4IzOBDn4u:ekroSfaMfFiRU9+tkl9yBDnj
Score10/10-
Gh0st RAT payload
-
Server Software Component: Terminal Services DLL
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Drops file in System32 directory
-