Overview

overview

10

Static

static

10

226c1e4165...18.exe

windows7-x64

10

226c1e4165...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    226c1e41650c6dd580f6e064b85b124f_JaffaCakes118

  • Size

    995KB

  • Sample

    240703-pystvswaqc

  • MD5

    226c1e41650c6dd580f6e064b85b124f

  • SHA1

    5a1f24f0837df7d3dcd62114bc2e763ad57a8491

  • SHA256

    0ef476b2145bf764f3db45e7e30ab69d7a52c187fa1e389dfcd33d142619a79d

  • SHA512

    e958114c593821da174dd152f785a32ba3b916ec51cf507f8da2dd43b58d7f262046d87deb059dd85be57b7b1f1bc7eef081ca06658b8e90251b90a5f513bc71

  • SSDEEP

    12288:iM5jZKbBL3aKHx5r+TuxX+fWbwFBfdGmZP:iM5j8Z3aKHx5r+TuxX+IwffFZP

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      226c1e41650c6dd580f6e064b85b124f_JaffaCakes118

    • Size

      995KB

    • MD5

      226c1e41650c6dd580f6e064b85b124f

    • SHA1

      5a1f24f0837df7d3dcd62114bc2e763ad57a8491

    • SHA256

      0ef476b2145bf764f3db45e7e30ab69d7a52c187fa1e389dfcd33d142619a79d

    • SHA512

      e958114c593821da174dd152f785a32ba3b916ec51cf507f8da2dd43b58d7f262046d87deb059dd85be57b7b1f1bc7eef081ca06658b8e90251b90a5f513bc71

    • SSDEEP

      12288:iM5jZKbBL3aKHx5r+TuxX+fWbwFBfdGmZP:iM5j8Z3aKHx5r+TuxX+IwffFZP

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks