gh0strat | 22b7bc418142b622a2c8786e3e0ee838_JaffaCakes118

General

Target

22b7bc418142b622a2c8786e3e0ee838_JaffaCakes118
Size

196KB
MD5

22b7bc418142b622a2c8786e3e0ee838
SHA1

68ce9ecd6ca45a4fda65aca6094fb347fbb69924
SHA256

9bf7a95b286747404f066f68a8636e2aa7e2764490041a4e1c13abb087e994fe
SHA512

47c21a35761ebb1562af1ed66ab9e31b435e6d1dcad35067f37422a5a6e5f2a6960b38d7e5cd3260d4b5c486b593167764d8a330cc7866f6fad9571b2e4cc2cf
SSDEEP

6144:eSVhQxExiTRxmlbF8F2PEl1TBlkvznD1cK:8KxcRM5S2PEDT3k3j

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
22b7bc418142b622a2c8786e3e0ee838_JaffaCakes118

Files

22b7bc418142b622a2c8786e3e0ee838_JaffaCakes118
.exe windows:4 windows x86 arch:x86

35ccae575f4ffe410086d2a41f1a48e2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

shell32

ShellExecuteA

kernel32

GetCommandLineA
FreeLibrary
CloseHandle
GetCurrentProcess
GetLastError
CreateDirectoryA
GetFileAttributesA
DeleteFileA
SetFileAttributesA
GetSystemDirectoryA
GetModuleHandleA
GetProcAddress
Sleep
ExitProcess
LoadLibraryA
FreeResource
WriteFile
CreateFileA
GetModuleFileNameA
LockResource
LoadResource
SizeofResource
FindResourceA
GetCurrentDirectoryA
GetTempPathA
MoveFileA
SetFilePointer
SleepEx
CreateEventA
WaitForSingleObject
ExpandEnvironmentStringsA
SetEnvironmentVariableA
SetUnhandledExceptionFilter
CreateProcessA
GetStartupInfoA
CopyFileA
InterlockedExchange
GetCurrentThreadId
GetTickCount
IsBadWritePtr
RaiseException
LocalAlloc

msvcrt

_ftol
tolower
strncmp
_except_handler3
memset
srand
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
__CxxFrameHandler
memmove
_itoa
rand

ws2_32

closesocket
getprotobynumber

Sections

text
Size: 16KB - Virtual size: 14KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 164KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

35ccae575f4ffe410086d2a41f1a48e2

Headers

File Characteristics

Imports

shell32

kernel32

msvcrt

ws2_32

Sections

text Size: 16KB - Virtual size: 14KB

.rdata Size: 4KB - Virtual size: 3KB

.data Size: 164KB - Virtual size: 165KB

.rsrc Size: 8KB - Virtual size: 4KB

text
Size: 16KB - Virtual size: 14KB

.rdata
Size: 4KB - Virtual size: 3KB

.data
Size: 164KB - Virtual size: 165KB

.rsrc
Size: 8KB - Virtual size: 4KB