Overview

overview

10

Static

static

3

30c4cbcfba...18.exe

windows7-x64

10

30c4cbcfba...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    30c4cbcfba69b7339c999ab4dd28c363_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240709-rxcglaybrm

  • MD5

    30c4cbcfba69b7339c999ab4dd28c363

  • SHA1

    6023d0117cb57e7691b715725b07afdfdbec7f0d

  • SHA256

    2656203d9707252e5753908da5966148252152f6152e9a8aa392c05ab6894c19

  • SHA512

    ef8db35455c9ea8519e1792b50d2705b430aa76b6a31bfa67d8ff8f9b8b2c6608490019947064a03b0a9b8b8218ff99f036444e06baa92cbb8b267b289c6e273

  • SSDEEP

    24576:QMbajQEsOwg/lle0Pm5gxkx6CmhJNqqI9g+X04qUtC9L9k9S:QMbIQ/lgNlLmueD8kY+E4dCt97

Score
10/10
gh0stratadwareaspackv2defense_evasionevasionpersistenceratstealerupx

Malware Config

Targets

    • Target

      30c4cbcfba69b7339c999ab4dd28c363_JaffaCakes118

    • Size

      1.1MB

    • MD5

      30c4cbcfba69b7339c999ab4dd28c363

    • SHA1

      6023d0117cb57e7691b715725b07afdfdbec7f0d

    • SHA256

      2656203d9707252e5753908da5966148252152f6152e9a8aa392c05ab6894c19

    • SHA512

      ef8db35455c9ea8519e1792b50d2705b430aa76b6a31bfa67d8ff8f9b8b2c6608490019947064a03b0a9b8b8218ff99f036444e06baa92cbb8b267b289c6e273

    • SSDEEP

      24576:QMbajQEsOwg/lle0Pm5gxkx6CmhJNqqI9g+X04qUtC9L9k9S:QMbIQ/lgNlLmueD8kY+E4dCt97

    Score
    10/10
    gh0stratadwareaspackv2evasionpersistenceratstealerupxdefense_evasion

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Modifies WinLogon for persistence

      persistence

    • Drops file in Drivers directory

    • Server Software Component: Terminal Services DLL

      persistence

    • Sets file to hidden

      Modifies file attributes to stop it showing in Explorer etc.

      evasion

    • Sets service image path in registry

      persistence

    • ACProtect 1.3x - 1.4x DLL software

      Detects file using ACProtect software.

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Impair Defenses: Safe Mode Boot

      defense_evasion

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Installs/modifies Browser Helper Object

      BHOs are DLL modules which act as plugins for Internet Explorer.

      stealeradware

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks