Overview

overview

10

Static

static

10

093aafb3a6...18.exe

windows7-x64

10

093aafb3a6...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    093aafb3a64ce1c2ce77dbafc2743832_JaffaCakes118

  • Size

    229KB

  • Sample

    240624-shl8xsycma

  • MD5

    093aafb3a64ce1c2ce77dbafc2743832

  • SHA1

    99a4be3d97037e622d552f6677fe44e887f130e2

  • SHA256

    fa02a554ded15356c78d6eb8ec5fc24efa30d46e1f535cfc639607eecd3c2735

  • SHA512

    a547472430b0100d038870f653e697eef488a127833da6072ed4025d603631523c3830ccfb942168acd49e498cd221b62026feb31bf8f0c7e1d87bc9f3d59297

  • SSDEEP

    6144:YFYHOoTSCCcJGDtjuDJvdTSCCcJG9tjuHJv5:OE7CcYDodh7CcY9oph

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      093aafb3a64ce1c2ce77dbafc2743832_JaffaCakes118

    • Size

      229KB

    • MD5

      093aafb3a64ce1c2ce77dbafc2743832

    • SHA1

      99a4be3d97037e622d552f6677fe44e887f130e2

    • SHA256

      fa02a554ded15356c78d6eb8ec5fc24efa30d46e1f535cfc639607eecd3c2735

    • SHA512

      a547472430b0100d038870f653e697eef488a127833da6072ed4025d603631523c3830ccfb942168acd49e498cd221b62026feb31bf8f0c7e1d87bc9f3d59297

    • SSDEEP

      6144:YFYHOoTSCCcJGDtjuDJvdTSCCcJG9tjuHJv5:OE7CcYDodh7CcY9oph

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Server Software Component: Terminal Services DLL

      persistence

    • Deletes itself

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks