Overview

overview

10

Static

static

3

27ab878981...18.exe

windows7-x64

10

27ab878981...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    27ab87898138d1f36d5ab65bca84dd02_JaffaCakes118

  • Size

    96KB

  • Sample

    240706-hyb3sasemd

  • MD5

    27ab87898138d1f36d5ab65bca84dd02

  • SHA1

    efad7a5c4e2755769b0e2fde4df5a0439a278360

  • SHA256

    d0c0bcafa5418dba43f3a86a7d91270d8ce8ef42c5cd66bb25c6672cdf022b66

  • SHA512

    aba0ccc8b654cf7e69851535c5d80af0295185b25cd78468565bc4fd90385403d519f539877f44484642ae316a2df3f98ef829b5e49ab2e6d087da2aa7abc1a9

  • SSDEEP

    1536:caFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prt9w/NZtEdkP+:cAS4jHS8q/3nTzePCwNUh4E9tCFfE2P+

Score
10/10
gh0stratbootkitpersistencerat

Malware Config

Targets

    • Target

      27ab87898138d1f36d5ab65bca84dd02_JaffaCakes118

    • Size

      96KB

    • MD5

      27ab87898138d1f36d5ab65bca84dd02

    • SHA1

      efad7a5c4e2755769b0e2fde4df5a0439a278360

    • SHA256

      d0c0bcafa5418dba43f3a86a7d91270d8ce8ef42c5cd66bb25c6672cdf022b66

    • SHA512

      aba0ccc8b654cf7e69851535c5d80af0295185b25cd78468565bc4fd90385403d519f539877f44484642ae316a2df3f98ef829b5e49ab2e6d087da2aa7abc1a9

    • SSDEEP

      1536:caFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prt9w/NZtEdkP+:cAS4jHS8q/3nTzePCwNUh4E9tCFfE2P+

    Score
    10/10
    gh0stratbootkitpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks