Behavioral task
behavioral1
Sample
3c25319ea5e301c7a3e646464d47ee72_JaffaCakes118.dll
Resource
win7-20240705-en
General
-
Target
3c25319ea5e301c7a3e646464d47ee72_JaffaCakes118
-
Size
109KB
-
MD5
3c25319ea5e301c7a3e646464d47ee72
-
SHA1
2e0d52b9364cf0abf3f2e7362a9e97ba19b9da02
-
SHA256
2f4b9abecc9897ab9513ebe0aadb66275c75237cf3abcddd8fc94d486130b809
-
SHA512
9b15ed751cf1d0c45010985ea8fd2640790767ce8132e9ecf8bc75ac229568d24f103c26c157be97c9c6ae23b8715cacb066e3d65748851eeac3385d200c8c73
-
SSDEEP
1536:LVz2W0IVqiO82V5rNSPkUcc2qj3fG4OyE6Mktl/U3DYI7TGgTWlOqw:12W0kHO82VisUL22vG4Op4NU3X3GgqHw
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
3c25319ea5e301c7a3e646464d47ee72_JaffaCakes118.dll windows:4 windows x86 arch:x86
023e4bd1d47262ecda41b5406a9d00c5
Code Sign
4b:59:40:99:47:b8:cf:a3:46:30:ca:cf:58:ad:ab:caCertificate
IssuerCN=VeriSign Class 3 Code Signing 2004 CANot Before06/09/2010, 04:17Not After31/12/2039, 23:59SubjectCN=VeriSign Class 3 Code Signing 2004 CA7f:1c:c7:b7:c6:bd:d0:9d:4f:2b:e2:73:62:9e:60:54Certificate
IssuerCN=VeriSign Class 3 Code Signing 2004 CANot Before08/09/2010, 15:54Not After31/12/2039, 23:59SubjectCN=Kaspersky Lab9a:c1:a7:69:2c:ab:79:36:b1:8d:ac:74:d9:db:3a:e6:71:98:29:34Signer
Actual PE Digest9a:c1:a7:69:2c:ab:79:36:b1:8d:ac:74:d9:db:3a:e6:71:98:29:34Digest Algorithmsha1PE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CreateEventA
CloseHandle
TerminateThread
WaitForSingleObject
SetEvent
ResumeThread
CreateThread
InitializeCriticalSection
DeleteCriticalSection
VirtualFree
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
ResetEvent
InterlockedExchange
CancelIo
Sleep
lstrlenA
GetPrivateProfileSectionNamesA
GetProcAddress
LoadLibraryA
FreeLibrary
WideCharToMultiByte
GetPrivateProfileStringA
DeleteFileA
CreateProcessA
GetDiskFreeSpaceExA
FindClose
LocalFree
LocalReAlloc
LocalAlloc
RemoveDirectoryA
GetFileSize
ReadFile
SetFilePointer
MoveFileA
SetLastError
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
OpenProcess
lstrcpyA
GetLocalTime
ExpandEnvironmentStringsA
HeapFree
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GetStartupInfoA
CreatePipe
DisconnectNamedPipe
TerminateProcess
PeekNamedPipe
WaitForMultipleObjects
DeviceIoControl
ReleaseMutex
OpenEventA
SetErrorMode
SetUnhandledExceptionFilter
FreeConsole
LocalSize
lstrcmpiA
GetCurrentThreadId
GetLastError
RaiseException
msvcrt
strncpy
atoi
wcscpy
strncat
strrchr
wcstombs
_beginthreadex
calloc
??1type_info@@UAE@XZ
_except_handler3
free
malloc
strchr
_CxxThrowException
strstr
_ftol
ceil
memmove
realloc
__CxxFrameHandler
??3@YAXPAX@Z
??2@YAPAXI@Z
_strnset
_strnicmp
_strrev
_strcmpi
msvcp60
?_Xran@std@@YAXXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
Exports
Exports
RavMonD
ServiceMain
avp
Sections
.text Size: 89KB - Virtual size: 88KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.HELLO Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.HOW Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.ARE Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.YOU Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.CRT Size: 512B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 1024B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 6KB - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ