gh0strat | 19572af2d53de9d290365c1a6dd6e748_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

19572af2d53de9d290365c1a6dd6e748_JaffaCakes118
Size

148KB
MD5

19572af2d53de9d290365c1a6dd6e748
SHA1

b31dfba8d6e4bb07f8bc085daf7a5ebaeff97a4a
SHA256

22476a4f61683c718ec4899d5a33d48830ec7aae6f4e84d03f0afae735f0845e
SHA512

ffdf7a5a3984d851a1209b2f6984521ce1f8b0ab02d41d1956a07f24ff454d9b632f5181e83ad40cac629fa3137d15a4ede5ab443f807af1fefe594fb2ab823a
SSDEEP

3072:lERE11AA4hmjdlaW+lOO/DjO2aMw6vYkSrYS63hSTfTTBftUOrOo:lEWd3CDjOLMwaYkSrYS63hSTfTTBlU9o

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
19572af2d53de9d290365c1a6dd6e748_JaffaCakes118

Files

19572af2d53de9d290365c1a6dd6e748_JaffaCakes118
.dll windows:4 windows x86 arch:x86

e9d96d76d77ed65b6ffee63b75a3708e

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

LeaveCriticalSection
GetTickCount
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
VirtualQuery
InitializeCriticalSection
GetModuleFileNameA
SetUnhandledExceptionFilter
GetLocalTime
FormatMessageA
IsBadWritePtr
GetLastError
GetCurrentThreadId
lstrcmpiA
GetShortPathNameA
GetTempFileNameA
HeapFree
GetProcessHeap
HeapAlloc
FreeLibrary
GetSystemInfo
GetProcessTimes
GetCurrentProcess
GlobalMemoryStatusEx
DeleteFileA
RemoveDirectoryA
ExitThread
IsBadReadPtr
IsBadStringPtrW
GetCommandLineA
GetCurrentProcessId
GetFileAttributesExA
lstrcmpA
MultiByteToWideChar
SetEnvironmentVariableA
GetTempPathA
GetLongPathNameA
ExitProcess
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
GetSystemDirectoryA
InterlockedExchange
GetModuleHandleA
GetVersionExA
GetProcAddress
LoadLibraryA
RaiseException
LocalAlloc

advapi32

RegRestoreKeyA
RegSaveKeyA
RegOpenKeyExW
RegisterServiceCtrlHandlerExA

shlwapi

SHDeleteKeyA

user32

GetCursorInfo
PtInRect
DestroyCursor
LoadCursorA
GetWindowRect
EnableWindow
ShowWindow
GetWindow
GetClassNameA
CloseWindowStation
MessageBoxA
wsprintfA
wvsprintfA
DestroyWindow
CreateWindowExA
SendMessageTimeoutA
CopyRect

msvcrt

_ftol
srand
_onexit
__dllonexit
_adjust_fdiv
_initterm
_stricmp
_strupr
_strlwr
_memicmp
_wcsicmp
realloc
wcstombs
atoi
strncpy
wcslen
__CxxFrameHandler
strchr
_callnewh
malloc
free
memmove
ceil
rand
strncat
_except_handler3
strrchr
_beginthreadex
time

Exports

Exports

IcfgGetLastInstallErrorText
IcfgInstallInetComponents
IcfgInstallModem
IcfgIsFileSharingTurnedOn
IcfgIsGlobalDNS
IcfgNeedInetComponents
IcfgNeedModem
IcfgRemoveGlobalDNS
IcfgSetInstallSourcePath
IcfgStartServices
IcfgTurnOffFileSharing
InetGetAutodial
InetGetSupportedPlatform

Sections

.text
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 294B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e9d96d76d77ed65b6ffee63b75a3708e

Headers

File Characteristics

Imports

kernel32

advapi32

shlwapi

user32

msvcrt

Exports

Exports

Sections

.text Size: 100KB - Virtual size: 99KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 12KB - Virtual size: 17KB

.rsrc Size: 4KB - Virtual size: 294B

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 100KB - Virtual size: 99KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 12KB - Virtual size: 17KB

.rsrc
Size: 4KB - Virtual size: 294B

.reloc
Size: 8KB - Virtual size: 7KB