Overview

overview

10

Static

static

3

2281c1ecb6...18.exe

windows7-x64

10

2281c1ecb6...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2281c1ecb617254ff6e4b8782e6df1ce_JaffaCakes118

  • Size

    183KB

  • Sample

    240703-qqxnhsybrh

  • MD5

    2281c1ecb617254ff6e4b8782e6df1ce

  • SHA1

    c844a9d926a04a38651cd143fb385ea4b6e6097f

  • SHA256

    42040200750951be020cb613f4a8064ab9819ae12009c5f604c2e3bb727d6291

  • SHA512

    d828e881b21ff547683b789f1b9c0a0d4f9fe63d44ed2f15954d2555bb65510fc5e149a77dd13235c813fc3e907965c2a50e70561f10052f3e2f7694a36fd514

  • SSDEEP

    3072:E0PvR+ug5tLk8uWslG4tOAC2AzXwKRhy+uWZETDGnE+YQfjZtEShOH4IFpI:E0PJZg5B3slG4JATSjKEIdtxOYITI

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      2281c1ecb617254ff6e4b8782e6df1ce_JaffaCakes118

    • Size

      183KB

    • MD5

      2281c1ecb617254ff6e4b8782e6df1ce

    • SHA1

      c844a9d926a04a38651cd143fb385ea4b6e6097f

    • SHA256

      42040200750951be020cb613f4a8064ab9819ae12009c5f604c2e3bb727d6291

    • SHA512

      d828e881b21ff547683b789f1b9c0a0d4f9fe63d44ed2f15954d2555bb65510fc5e149a77dd13235c813fc3e907965c2a50e70561f10052f3e2f7694a36fd514

    • SSDEEP

      3072:E0PvR+ug5tLk8uWslG4tOAC2AzXwKRhy+uWZETDGnE+YQfjZtEShOH4IFpI:E0PJZg5B3slG4JATSjKEIdtxOYITI

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Server Software Component: Terminal Services DLL

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks