Behavioral task
behavioral1
Sample
3ea8214ae815bfdfd4bff644c22db594_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
3ea8214ae815bfdfd4bff644c22db594_JaffaCakes118
-
Size
97KB
-
MD5
3ea8214ae815bfdfd4bff644c22db594
-
SHA1
492618e2684453b8049f97524770e08626dfda76
-
SHA256
98fb377eadddf1597ef274e44c13196e72d41a6287422c3701648fd922583ced
-
SHA512
64aacb33107ad660fe90ef79c0fb78ef557af4f615423484a14bdb951aabfed1bb26ebc1a3310d6e573b576f0256da89efb30d9aa59ab7306a1ad2bcb786f284
-
SSDEEP
3072:OBESyGk1Vm6Ek3U+ZM+1qhKIq368oYwTB4:OBESyGk1Vm6nkx+cxqKpfi
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3ea8214ae815bfdfd4bff644c22db594_JaffaCakes118
Files
-
3ea8214ae815bfdfd4bff644c22db594_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 87KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ