Overview

overview

10

Static

static

10

3abd7968bb...18.dll

windows7-x64

10

3abd7968bb...18.dll

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    3abd7968bb62ca2a29e2a66914fbeef7_JaffaCakes118

  • Size

    109KB

  • Sample

    240711-z4qlssvamp

  • MD5

    3abd7968bb62ca2a29e2a66914fbeef7

  • SHA1

    c7f0f43b51481be448f602f5749fc704601d91f2

  • SHA256

    626ff56088c128b34e33715cb6b671c35a4a356c0f65a5f272e6c0915b0f0fa9

  • SHA512

    bf53da76e6a53e89d51b89bb549076796fce622a650d41afbe350fdc93a19233accba8d19ae987c98f95bf5d1f03d00de3373127918334abe2c8277e50dc45f1

  • SSDEEP

    1536:8LiaPFEt7NtE2v8/Rv0e+C5LOac9PLfiJeTuxjkcTw8Or1N1Yj:8LfPFS5e/Zs6OaCPbiJeCFkcTw8Or/O

Score
10/10
gh0stratrat

Malware Config

Targets

    • Target

      3abd7968bb62ca2a29e2a66914fbeef7_JaffaCakes118

    • Size

      109KB

    • MD5

      3abd7968bb62ca2a29e2a66914fbeef7

    • SHA1

      c7f0f43b51481be448f602f5749fc704601d91f2

    • SHA256

      626ff56088c128b34e33715cb6b671c35a4a356c0f65a5f272e6c0915b0f0fa9

    • SHA512

      bf53da76e6a53e89d51b89bb549076796fce622a650d41afbe350fdc93a19233accba8d19ae987c98f95bf5d1f03d00de3373127918334abe2c8277e50dc45f1

    • SSDEEP

      1536:8LiaPFEt7NtE2v8/Rv0e+C5LOac9PLfiJeTuxjkcTw8Or1N1Yj:8LfPFS5e/Zs6OaCPbiJeCFkcTw8Or/O

    Score
    10/10
    gh0stratrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks