gh0strat | 2e1b2614c8571e788334b448e36133cf_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

2e1b2614c8571e788334b448e36133cf_JaffaCakes118
Size

107KB
MD5

2e1b2614c8571e788334b448e36133cf
SHA1

de89221cab50d661fcf6ecf7380accda46d69854
SHA256

b70ee21bed9e042b30f991f65fe545be7acd8f826289519d431ef4a1bc66fda2
SHA512

db09a46c4d0b971ea451e09caf8bea9e89b1b6d58bcd94cdcf413458cbbfca4ad42f15bf53c328b2a90bc9c18e5c3ead11854d87460c1c9d5f2cbc718451a79d
SSDEEP

3072:Rt6XkozyxsPRRf9joJjqZCZ1UTpOmBAsn+Bxa/2CGwp4jqB:Rt6XkozyxsPDf5oJjqZUO8mGY7/2CGw5

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

2e1b2614c8571e788334b448e36133cf_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Code Sign

4e:23:3a:f2:12:5a:03:9e:48:f6:e5:a5:7f:6f:6b:06
Certificate

Issuer

CN=www.gh0st2009.cn \

Not Before

31/12/2007, 16:00

Not After

31/12/2013, 16:00

Subject

CN=www.gh0st2009.cn \

Extended Key Usages

ExtKeyUsageCodeSigning

22:5c:20:bb:53:00:fb:ad:3c:cd:a8:cb:db:39:d5:70:e0:3d:ac:65
Signer

Actual PE Digest

22:5c:20:bb:53:00:fb:ad:3c:cd:a8:cb:db:39:d5:70:e0:3d:ac:65

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Exports

Exports

JustTempLMHKFun

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 94KB - Virtual size: 94KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ