General

  • Target

    0699f8a0ec784fd5b07a5b2e568898ea_JaffaCakes118

  • Size

    100KB

  • Sample

    240623-r43x5avcqd

  • MD5

    0699f8a0ec784fd5b07a5b2e568898ea

  • SHA1

    e5c83ca5c1aadf74b902509cf796c129179a327a

  • SHA256

    e78b7ca8cdb7a26f156b50211b7b37504fb6c4da606434ac1566006ab07594b0

  • SHA512

    e3094759b91481beb017b52b7b1517f662b505f8963a220ed5af30d8b6fcdacb2a999cb36cb708ec3b270d34368ab961d83e4bac7b3c27bd703fe3cd20493c46

  • SSDEEP

    1536:JBsDeMQbFT3NgWOyd9hWdIcNdBfxOcwC/jqewEEx5q4F:J0eMQbPnhLWu6dxxOcN7qewEEx5RF

Malware Config

Targets

    • Target

      0699f8a0ec784fd5b07a5b2e568898ea_JaffaCakes118

    • Size

      100KB

    • MD5

      0699f8a0ec784fd5b07a5b2e568898ea

    • SHA1

      e5c83ca5c1aadf74b902509cf796c129179a327a

    • SHA256

      e78b7ca8cdb7a26f156b50211b7b37504fb6c4da606434ac1566006ab07594b0

    • SHA512

      e3094759b91481beb017b52b7b1517f662b505f8963a220ed5af30d8b6fcdacb2a999cb36cb708ec3b270d34368ab961d83e4bac7b3c27bd703fe3cd20493c46

    • SSDEEP

      1536:JBsDeMQbFT3NgWOyd9hWdIcNdBfxOcwC/jqewEEx5q4F:J0eMQbPnhLWu6dxxOcN7qewEEx5RF

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • Server Software Component: Terminal Services DLL

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks