General

  • Target

    05824665fd612ece2d26104f3e267d64_JaffaCakes118

  • Size

    61KB

  • Sample

    240623-h1ayhatdrh

  • MD5

    05824665fd612ece2d26104f3e267d64

  • SHA1

    62044d622877857d7ddeecd6dd454dfe6ba4a580

  • SHA256

    5d70af852ae589a8f4dbf1bb289400dc8c5b5017ad5bea4f7e734a8b831bc423

  • SHA512

    02e676a7e00f0a929c6072bb086a40ae8f04c5f53acdb1ebc8437513fcac6ab38bbb724bbf4bcb62fde3b7b3969cf65c497925c75d280e2f5b9709b7a2dec85a

  • SSDEEP

    1536:eGvxI12D/iZSaWPUqYMf7JiREeMX9+s3Um6oBHdh4IzOBDn4u:ekroSfaMfFiRU9+tkl9yBDnj

Malware Config

Targets

    • Target

      05824665fd612ece2d26104f3e267d64_JaffaCakes118

    • Size

      61KB

    • MD5

      05824665fd612ece2d26104f3e267d64

    • SHA1

      62044d622877857d7ddeecd6dd454dfe6ba4a580

    • SHA256

      5d70af852ae589a8f4dbf1bb289400dc8c5b5017ad5bea4f7e734a8b831bc423

    • SHA512

      02e676a7e00f0a929c6072bb086a40ae8f04c5f53acdb1ebc8437513fcac6ab38bbb724bbf4bcb62fde3b7b3969cf65c497925c75d280e2f5b9709b7a2dec85a

    • SSDEEP

      1536:eGvxI12D/iZSaWPUqYMf7JiREeMX9+s3Um6oBHdh4IzOBDn4u:ekroSfaMfFiRU9+tkl9yBDnj

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • Server Software Component: Terminal Services DLL

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks