Overview

overview

10

Static

static

3

10359ab59c...18.exe

windows7-x64

10

10359ab59c...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    10359ab59cb43715f7ec0043b2c14ab8_JaffaCakes118

  • Size

    109KB

  • Sample

    240626-bj4qxsyajj

  • MD5

    10359ab59cb43715f7ec0043b2c14ab8

  • SHA1

    b2e52853479caf74564d7650370367b2b3de8d42

  • SHA256

    49451e6fc22721a322b243dd919e9109ea1207102c91291bc976bb51e550893a

  • SHA512

    4cfd1dc8b8d0c27e142beddb409623489afa52fd4e5cd3e759bd8afb6776cc6e2f26209ca9d38e9a6c350973ca6b9564d452194307687319715c3d456a7d3cdf

  • SSDEEP

    1536:JRbygT9pE4NsBLr3Ka5NJduDyv6sonjUtU1LFuBDB7u/qXtp3qWU:J1yeEwsxua5QDDnjqQRABi/U7VU

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      10359ab59cb43715f7ec0043b2c14ab8_JaffaCakes118

    • Size

      109KB

    • MD5

      10359ab59cb43715f7ec0043b2c14ab8

    • SHA1

      b2e52853479caf74564d7650370367b2b3de8d42

    • SHA256

      49451e6fc22721a322b243dd919e9109ea1207102c91291bc976bb51e550893a

    • SHA512

      4cfd1dc8b8d0c27e142beddb409623489afa52fd4e5cd3e759bd8afb6776cc6e2f26209ca9d38e9a6c350973ca6b9564d452194307687319715c3d456a7d3cdf

    • SSDEEP

      1536:JRbygT9pE4NsBLr3Ka5NJduDyv6sonjUtU1LFuBDB7u/qXtp3qWU:J1yeEwsxua5QDDnjqQRABi/U7VU

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Server Software Component: Terminal Services DLL

      persistence

    • Deletes itself

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks