Behavioral task
behavioral1
Sample
4073e4767698145a107e25eeb0579f53_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
4073e4767698145a107e25eeb0579f53_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
4073e4767698145a107e25eeb0579f53_JaffaCakes118
-
Size
92KB
-
MD5
4073e4767698145a107e25eeb0579f53
-
SHA1
c6e0f1188a9810799c45787c7598d8bc2fd6efad
-
SHA256
b53aff7efb3e820bd655dd58f7ac7d468865fa89637b0911f6dd3e0097160883
-
SHA512
fc4962519c02f346dab5fd8b3b43ec938789b9cc62791d0206f81ac08d4d8f6fb20c338fb445e1e342a73debb85d79042aabbd4557bd2b1fa3b90d12e8ea9bf2
-
SSDEEP
1536:cXKUasg2h8qOdYqLDfhjw1qcpuufa3sDeOgbxewmw5QVl:9UasgBYkDfNw1q2uoa3sKOYewmw5QP
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 4073e4767698145a107e25eeb0579f53_JaffaCakes118
Files
-
4073e4767698145a107e25eeb0579f53_JaffaCakes118.exe windows:4 windows x86 arch:x86
329471665f5c4c5f677765b61d503254
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameA
lstrlenA
LoadLibraryA
MoveFileExA
DeleteFileA
FreeResource
GetSystemDirectoryA
CreateFileA
GlobalAlloc
lstrcpyA
lstrcmpiA
SetLastError
LoadResource
FindResourceA
SizeofResource
Sleep
ExitProcess
CreateThread
VirtualAlloc
CloseHandle
VirtualAllocEx
VirtualProtectEx
GetModuleHandleA
GetProcAddress
WriteProcessMemory
SetThreadContext
ResumeThread
TerminateProcess
CreateProcessW
GetThreadContext
ReadProcessMemory
VirtualQueryEx
GetTickCount
lstrcatA
WriteFile
GetLastError
RaiseException
InterlockedExchange
LocalAlloc
FreeLibrary
gdi32
GetStockObject
advapi32
OpenSCManagerA
CreateServiceA
CloseServiceHandle
OpenServiceA
ChangeServiceConfigA
StartServiceA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
msvcrt
strlen
??2@YAPAXI@Z
fread
ftell
fseek
fclose
fopen
memcpy
strstr
realloc
malloc
__CxxFrameHandler
_CxxThrowException
??3@YAXPAX@Z
??1type_info@@UAE@XZ
strcat
strchr
_except_handler3
_strrev
Sections
.text Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.MUTI Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 81KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ