Overview

overview

10

Static

static

10

0a5d535016...18.exe

windows7-x64

10

0a5d535016...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0a5d535016d1745005730a5c4906f044_JaffaCakes118

  • Size

    100KB

  • Sample

    240624-xzx4za1hlq

  • MD5

    0a5d535016d1745005730a5c4906f044

  • SHA1

    ab36e882e07f9b1821f475cc6e3b2acc750f9059

  • SHA256

    d51bdf230084acbbd2e264f5af20b435b6cbf48b5f2a65a0c187af51586c663d

  • SHA512

    c1c3d9bcd497a04e8e4181b9ba39bed27fc558582f1441d2c3d6eaad3fa2d2582786f1e1f2bd06adb74cca81ef6d3bc0e9f05bb6344df03c7fc5205f43d31a76

  • SSDEEP

    1536:0ZKLXRt8zpIm5Ojz+6C2Rcu+1fafcGr1V6XDpQ4/ZCx5l6:0ZKLXRwIZpnRp+tafciT6lQ4/ZCx5l6

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      0a5d535016d1745005730a5c4906f044_JaffaCakes118

    • Size

      100KB

    • MD5

      0a5d535016d1745005730a5c4906f044

    • SHA1

      ab36e882e07f9b1821f475cc6e3b2acc750f9059

    • SHA256

      d51bdf230084acbbd2e264f5af20b435b6cbf48b5f2a65a0c187af51586c663d

    • SHA512

      c1c3d9bcd497a04e8e4181b9ba39bed27fc558582f1441d2c3d6eaad3fa2d2582786f1e1f2bd06adb74cca81ef6d3bc0e9f05bb6344df03c7fc5205f43d31a76

    • SSDEEP

      1536:0ZKLXRt8zpIm5Ojz+6C2Rcu+1fafcGr1V6XDpQ4/ZCx5l6:0ZKLXRwIZpnRp+tafciT6lQ4/ZCx5l6

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Server Software Component: Terminal Services DLL

      persistence

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks