Behavioral task
behavioral1
Sample
2aa06aeae549a7d97e0f8434358b7577_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
2aa06aeae549a7d97e0f8434358b7577_JaffaCakes118
-
Size
147KB
-
MD5
2aa06aeae549a7d97e0f8434358b7577
-
SHA1
178891453aa5963f5a4f0d8f127137071233fab1
-
SHA256
56b1890d3970e86585659872b967f7b4b89d230e44634cef2935a3af263f0e53
-
SHA512
80a885949bbc74b2864ba6d17be01d027882b389f8abf2232ff8980b5379cf638f7ea938c0b7fa5be12b36fa1f2adacd025f8bfe69781963620c40eeedf508d8
-
SSDEEP
3072:gKyA9gZ8mrM47MQHEL/a3VnK8ahRsYFI8xALZ/N:gKy2eHETaFTarDFI8xwN
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 2aa06aeae549a7d97e0f8434358b7577_JaffaCakes118
Files
-
2aa06aeae549a7d97e0f8434358b7577_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: 88KB - Virtual size: 88KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 50KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE