Behavioral task
behavioral1
Sample
0e78fd65b8ee92a44d22d1abc4716c80_JaffaCakes118.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0e78fd65b8ee92a44d22d1abc4716c80_JaffaCakes118.exe
Resource
win10v2004-20240508-en
General
-
Target
0e78fd65b8ee92a44d22d1abc4716c80_JaffaCakes118
-
Size
828KB
-
MD5
0e78fd65b8ee92a44d22d1abc4716c80
-
SHA1
edbd2f2da3529e11def8c2ff4c23c16604d8b900
-
SHA256
4fe631015375a8f16d2a8551596fd160b67249014fed6479e11bbb6c521a6342
-
SHA512
572a82452e3e74cf99cadf6bf3af1b5fc19e0ac9ee4d5f0d50e3bb4c434c59d4231eb03dc3748803ff310652135857e370a1f54d051e8d451a8ae6398be6179a
-
SSDEEP
12288:/M5REAfL3aKHx5r+TuxXzNWJBhiFHzsVK2o/:/M5RE23aKHx5r+TuxXzcBsFHUo/
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0e78fd65b8ee92a44d22d1abc4716c80_JaffaCakes118
Files
-
0e78fd65b8ee92a44d22d1abc4716c80_JaffaCakes118.exe windows:4 windows x86 arch:x86
6e823d9b1eea64189ab47ad8b130d058
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WriteFile
SetFilePointer
GetModuleFileNameA
OpenProcess
SetFileAttributesA
CopyFileA
GlobalAlloc
GlobalLock
GlobalUnlock
GetStartupInfoA
WaitForSingleObject
GetLastError
CloseHandle
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
MultiByteToWideChar
DeviceIoControl
GetVersion
LocalAlloc
FindClose
GetVolumeInformationA
GetFileAttributesA
CreateDirectoryA
DeleteFileA
GetPrivateProfileStringA
FreeLibrary
lstrcatA
GetPrivateProfileSectionNamesA
lstrlenA
InterlockedExchange
lstrcpyA
WideCharToMultiByte
LoadLibraryA
GetProcAddress
RaiseException
GetModuleHandleA
gdi32
GetDIBits
DeleteDC
DeleteObject
CreateDIBSection
SelectObject
CreateCompatibleBitmap
advapi32
LsaClose
RegOpenKeyA
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegEnumValueA
LsaOpenPolicy
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenEventLogA
ClearEventLogA
CloseEventLog
RegQueryValueA
RegOpenKeyExA
RegCloseKey
LsaFreeMemory
IsValidSid
shell32
SHGetSpecialFolderPathA
ole32
CoInitialize
CoUninitialize
CoCreateInstance
CoTaskMemFree
oleaut32
SysFreeString
msvcrt
_CxxThrowException
strlen
??1exception@@UAE@XZ
_strcmpi
_strnset
_strnicmp
??2@YAPAXI@Z
??3@YAXPAX@Z
__CxxFrameHandler
memmove
ceil
_ftol
strstr
_purecall
strchr
malloc
free
_except_handler3
strrchr
fclose
fwrite
fopen
exit
atoi
strncmp
strncpy
_errno
wcscpy
strncat
sprintf
_beginthreadex
vsprintf
calloc
__dllonexit
_onexit
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
??0exception@@QAE@ABQBD@Z
memcpy
??0exception@@QAE@ABV0@@Z
??1type_info@@UAE@XZ
winmm
waveInOpen
waveInGetNumDevs
waveOutPrepareHeader
waveInPrepareHeader
waveInStop
waveOutWrite
waveInAddBuffer
waveInStart
waveOutOpen
waveOutClose
waveOutUnprepareHeader
waveOutReset
waveInReset
waveInUnprepareHeader
waveOutGetNumDevs
waveInClose
ws2_32
select
send
inet_ntoa
closesocket
getsockname
bind
getpeername
accept
listen
sendto
recvfrom
__WSAFDIsSet
gethostname
recv
ntohs
socket
WSAStartup
WSACleanup
gethostbyname
htons
connect
setsockopt
WSAIoctl
inet_addr
netapi32
NetUserAdd
NetLocalGroupAddMembers
wtsapi32
WTSFreeMemory
Sections
.rodata Size: 12KB - Virtual size: 10KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 40KB - Virtual size: 39KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 428KB - Virtual size: 889KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ