Behavioral task
behavioral1
Sample
27580c5f37fafe18b753bec3a6399678_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
27580c5f37fafe18b753bec3a6399678_JaffaCakes118.exe
Resource
win10v2004-20240704-en
General
-
Target
27580c5f37fafe18b753bec3a6399678_JaffaCakes118
-
Size
124KB
-
MD5
27580c5f37fafe18b753bec3a6399678
-
SHA1
b9565c63af6e5ea49c9c90a308fe37f80bf9d6d1
-
SHA256
617bcdb4e027fc5585c44d9e97c79aa1c3d0aa99fcbabdf085daf0d305937b71
-
SHA512
6dd8e9fbfdba3893b388abf0b980a5b9ec9570f7f30060ed9e1294844bac03940bcde91bc998f88887612fc6b2c77436950a87467fe19a1e8ca5db76b40c5702
-
SSDEEP
3072:2h4YpNvlMlvTjrOZIEq91g1yVFjMKOpiH/iAAgy6tGeOv30:S4IEvvrOZIEcksjDUgyXy
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 27580c5f37fafe18b753bec3a6399678_JaffaCakes118
Files
-
27580c5f37fafe18b753bec3a6399678_JaffaCakes118.exe windows:4 windows x86 arch:x86
eb2918dd7d32fc62954739599d78e4b2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
InitializeCriticalSection
DeleteCriticalSection
VirtualFree
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
CreateEventA
CloseHandle
WaitForSingleObject
ResetEvent
lstrcpyA
SetEvent
InterlockedExchange
CancelIo
Sleep
FreeLibrary
GetTickCount
GetTempPathA
WriteFile
SetFilePointer
CreateFileA
WritePrivateProfileStringA
TerminateThread
OutputDebugStringA
GetCurrentProcess
SetFileAttributesA
GetModuleFileNameA
DeleteFileA
CreateProcessA
GetProcAddress
LoadLibraryA
GetPrivateProfileStringA
GetVersionExA
GetSystemDefaultUILanguage
ReleaseMutex
OpenEventA
SetErrorMode
GetLastError
CreateMutexA
SetUnhandledExceptionFilter
SetThreadPriority
CreateThread
RtlUnwind
RaiseException
ExitProcess
TerminateProcess
GetCurrentThreadId
TlsSetValue
TlsGetValue
ExitThread
HeapFree
HeapAlloc
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
TlsAlloc
SetLastError
HeapReAlloc
HeapSize
UnhandledExceptionFilter
GetEnvironmentVariableA
HeapDestroy
HeapCreate
IsBadWritePtr
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
InterlockedDecrement
InterlockedIncrement
IsBadReadPtr
IsBadCodePtr
MultiByteToWideChar
GetStringTypeA
GetStringTypeW
GetCPInfo
GetACP
GetOEMCP
LCMapStringA
LCMapStringW
SetStdHandle
FlushFileBuffers
LocalAlloc
Sections
PAGE Size: 1024B - Virtual size: 944B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
PAGE1 Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 87KB - Virtual size: 87KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 21KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE