Overview

overview

10

Static

static

3

3e8574f66a...18.exe

windows7-x64

10

3e8574f66a...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3e8574f66a35ae0b578c6576086cc3a3_JaffaCakes118

  • Size

    546KB

  • Sample

    240712-xrxs8sydjc

  • MD5

    3e8574f66a35ae0b578c6576086cc3a3

  • SHA1

    d8e4b9c01b299121e9f1e07bb4a11d213e2c0b72

  • SHA256

    ce3a9db1b6123956acf0ede920bb024bd91a6f6a174cf1473935f1b6b0e0b185

  • SHA512

    b7a363945cd9cde2e71f528a2031ff2ea18c1b913e4aa2ba26cb0023b46044a36b05438c6ac5f7cc2cffae88d2dc4aaa3637f655f3c94bc6c5c94004458c887f

  • SSDEEP

    12288:wXXGxu5d+qPqQgXenGiqNeBcGyF3Z4mxxBSuCd6ZYyZOk:wXXnZPkI5wWAQmXBSuCdcROk

Score
10/10
gh0stratpersistencerat

Malware Config

Targets

    • Target

      3e8574f66a35ae0b578c6576086cc3a3_JaffaCakes118

    • Size

      546KB

    • MD5

      3e8574f66a35ae0b578c6576086cc3a3

    • SHA1

      d8e4b9c01b299121e9f1e07bb4a11d213e2c0b72

    • SHA256

      ce3a9db1b6123956acf0ede920bb024bd91a6f6a174cf1473935f1b6b0e0b185

    • SHA512

      b7a363945cd9cde2e71f528a2031ff2ea18c1b913e4aa2ba26cb0023b46044a36b05438c6ac5f7cc2cffae88d2dc4aaa3637f655f3c94bc6c5c94004458c887f

    • SSDEEP

      12288:wXXGxu5d+qPqQgXenGiqNeBcGyF3Z4mxxBSuCd6ZYyZOk:wXXnZPkI5wWAQmXBSuCdcROk

    Score
    10/10
    gh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Drops file in Drivers directory

    • Server Software Component: Terminal Services DLL

      persistence

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks