gh0strat | 363ffe90f46c5ea11357afb173df06e0_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

363ffe90f46c5ea11357afb173df06e0_JaffaCakes118
Size

106KB
MD5

363ffe90f46c5ea11357afb173df06e0
SHA1

df6ba974cd93dc3d9d0a1579c795766111e2890a
SHA256

9b3f7f037eaaf42361ee2cc609716e71ac220a755b2cc2551f1a856e9f7f2f32
SHA512

2713b6c5c98ab61a687680729177ee85524e4730cc26bc0bcae3e72a87418b9f0f23abcd7a5f007b90812c44ee0e5bd6946db8503f0ae7de1ed8ef11838e1b87
SSDEEP

3072:hL0HCycaaNJuRh/gBiE/3bNJFXGcw4WJSH:d0HCy4NsLgwYN32cwxJSH

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

363ffe90f46c5ea11357afb173df06e0_JaffaCakes118
.dll windows:4 windows x86 arch:x86

Code Sign

38:54:ef:0d:fa:98:68:66:17:98:c9:ec:c0:ed:d0:92:d2:38:61:4e
Signer

Actual PE Digest

38:54:ef:0d:fa:98:68:66:17:98:c9:ec:c0:ed:d0:92:d2:38:61:4e

Digest Algorithm

sha1

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

ServiceMain

Sections

.text
Size: 71KB - Virtual size: 71KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 11KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.Silvana
Size: 336B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bbs
Size: 1024B - Virtual size: 1024B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE