ServiceMain
Behavioral task
behavioral1
Sample
231fe3cb46e78d20ef1f6a62ebc3d55b_JaffaCakes118.dll
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
231fe3cb46e78d20ef1f6a62ebc3d55b_JaffaCakes118.dll
Resource
win10v2004-20240508-en
General
-
Target
231fe3cb46e78d20ef1f6a62ebc3d55b_JaffaCakes118
-
Size
101KB
-
MD5
231fe3cb46e78d20ef1f6a62ebc3d55b
-
SHA1
d486fff511cddc2d2009d287cb2d9bf2c4e00014
-
SHA256
7eb0d50805221fb39d46683e6c718f7abc77b7100192c666f98016014cbc3345
-
SHA512
d55b304dd1c2eb7db989f2c6ce1d4b1ba31b04c57e226fe17f71e211440e29c4480ad9e440b3edf3c6e20ae650ad5ef9fdc82def29ed68f7e34bdcffd0b0af56
-
SSDEEP
1536:C0Bq+fthdoYIdSgb8Jb516YVuRci/r3fBiUQ7SmZ7uKP3cc:vBPnk8p7lVuRh/rBiUQZaKP3cc
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 231fe3cb46e78d20ef1f6a62ebc3d55b_JaffaCakes118
Files
-
231fe3cb46e78d20ef1f6a62ebc3d55b_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
Sections
.text Size: 71KB - Virtual size: 71KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 11KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.!rc! Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 5KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ