Overview

overview

10

Static

static

10

2273045113...18.exe

windows7-x64

10

2273045113...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2273045113ec7dcfc174b5a083325702_JaffaCakes118

  • Size

    1.0MB

  • Sample

    240703-p8a2sswhjc

  • MD5

    2273045113ec7dcfc174b5a083325702

  • SHA1

    f15751fdea9ec7f80c4e4df4022d19ad8dab2be1

  • SHA256

    7e75ab7b5f7567d2c8cc47c19d8e5593b467da49c935103fb7a7729ef2109b45

  • SHA512

    490d170fe45af6876ffcd8cae54e4d4c4354ee122f39f30af8e3b9ce873d8be91d6f3fc310537151ca3d88851ad098086b6866b78b8c09f6093f0a6b9ef99a61

  • SSDEEP

    12288:iM5jZKbBL3aKHx5r+TuxX+fWbwFBfdGmZ9HANUTNE:iM5j8Z3aKHx5r+TuxX+IwffFZW

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      2273045113ec7dcfc174b5a083325702_JaffaCakes118

    • Size

      1.0MB

    • MD5

      2273045113ec7dcfc174b5a083325702

    • SHA1

      f15751fdea9ec7f80c4e4df4022d19ad8dab2be1

    • SHA256

      7e75ab7b5f7567d2c8cc47c19d8e5593b467da49c935103fb7a7729ef2109b45

    • SHA512

      490d170fe45af6876ffcd8cae54e4d4c4354ee122f39f30af8e3b9ce873d8be91d6f3fc310537151ca3d88851ad098086b6866b78b8c09f6093f0a6b9ef99a61

    • SSDEEP

      12288:iM5jZKbBL3aKHx5r+TuxX+fWbwFBfdGmZ9HANUTNE:iM5j8Z3aKHx5r+TuxX+IwffFZW

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks