Overview

overview

10

Static

static

10

2417028b83...18.exe

windows7-x64

10

2417028b83...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    2417028b835751a709121e1ee8bd7ff6_JaffaCakes118

  • Size

    956KB

  • Sample

    240704-badhdaxcla

  • MD5

    2417028b835751a709121e1ee8bd7ff6

  • SHA1

    4a22dc1c2ea4316b6b3b58bff434ec5b2fbfe2b9

  • SHA256

    a04e011111661a52371322846a3f1200d094ed7eb80c07396be9e398e7503251

  • SHA512

    7941bd5be3c5865f37baf3a92576e1083935e2880e00ca88addf0f00694a966353fbd2d796ed8ae8113008a874fc18a5745e628e0ad49f7a2e170e62a628ca8e

  • SSDEEP

    12288:iM5jZKbBL3aKHx5r+TuxX+fWbwFBfdGmZM:iM5j8Z3aKHx5r+TuxX+IwffFZM

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      2417028b835751a709121e1ee8bd7ff6_JaffaCakes118

    • Size

      956KB

    • MD5

      2417028b835751a709121e1ee8bd7ff6

    • SHA1

      4a22dc1c2ea4316b6b3b58bff434ec5b2fbfe2b9

    • SHA256

      a04e011111661a52371322846a3f1200d094ed7eb80c07396be9e398e7503251

    • SHA512

      7941bd5be3c5865f37baf3a92576e1083935e2880e00ca88addf0f00694a966353fbd2d796ed8ae8113008a874fc18a5745e628e0ad49f7a2e170e62a628ca8e

    • SSDEEP

      12288:iM5jZKbBL3aKHx5r+TuxX+fWbwFBfdGmZM:iM5j8Z3aKHx5r+TuxX+IwffFZM

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks