Behavioral task
behavioral1
Sample
40a55e2bc517e905f305591a33f66416_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
40a55e2bc517e905f305591a33f66416_JaffaCakes118.exe
Resource
win10v2004-20240709-en
General
-
Target
40a55e2bc517e905f305591a33f66416_JaffaCakes118
-
Size
5.1MB
-
MD5
40a55e2bc517e905f305591a33f66416
-
SHA1
c315169fdff6668ac2c764f19b91c1131c61f9a1
-
SHA256
617f1a1bdb6fc094b092d723cf380f35f4ca63c455f94249f42dabeee2b2b040
-
SHA512
59178ce82a3cf1e5376dd477c7f6fc2ea38ea94de96027bbc9f4f23d7fe8ab40e3886be9d7383815ca4d232fd912989d3eafc1152af19e633a609ab05ceb97ed
-
SSDEEP
3072:hSz8YrxVntJpC5E4PmzEcTnWRyOO32D3AFWJrDy:I8YbtJmm4KWYWD3AAJvy
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 40a55e2bc517e905f305591a33f66416_JaffaCakes118
Files
-
40a55e2bc517e905f305591a33f66416_JaffaCakes118.exe windows:4 windows x86 arch:x86
3b32a094ae5068623b24c460d2f664cc
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
WaitForSingleObject
SetEvent
ResumeThread
CreateThread
InitializeCriticalSection
DeleteCriticalSection
VirtualFree
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
ResetEvent
lstrcpyA
InterlockedExchange
CancelIo
Sleep
lstrlenA
GetPrivateProfileSectionNamesA
lstrcatA
GetWindowsDirectoryA
FreeLibrary
GetProcAddress
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
lstrcmpA
GetPrivateProfileStringA
GetVersionExA
DeleteFileA
GetLastError
CreateDirectoryA
GetFileAttributesA
CreateProcessA
WinExec
GetDriveTypeA
GetDiskFreeSpaceExA
GetVolumeInformationA
GetLogicalDriveStringsA
FindClose
LocalFree
FindNextFileA
LocalReAlloc
FindFirstFileA
LocalAlloc
RemoveDirectoryA
GetFileSize
CreateFileA
ReadFile
SetFilePointer
WriteFile
MoveFileA
GetModuleFileNameA
TerminateThread
GetLocalTime
OutputDebugStringA
GlobalMemoryStatusEx
GetComputerNameA
GetTickCount
LocalSize
GetCurrentProcess
OpenProcess
Process32Next
Process32First
CreateToolhelp32Snapshot
ExitProcess
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GetStartupInfoA
CreatePipe
DisconnectNamedPipe
TerminateProcess
PeekNamedPipe
WaitForMultipleObjects
GlobalMemoryStatus
GetSystemInfo
CopyFileA
GetLogicalDrives
SetFileAttributesA
ExpandEnvironmentStringsA
GetModuleHandleA
FreeResource
SizeofResource
LockResource
LoadResource
FindResourceA
ReleaseMutex
OpenEventA
SetErrorMode
MoveFileExA
SetPriorityClass
GetCurrentProcessId
CreateMutexA
GetCurrentThreadId
lstrcmpiA
RaiseException
CloseHandle
GetSystemDirectoryA
CreateEventA
msvcrt
ceil
_ftol
strstr
_CxxThrowException
strchr
malloc
free
_except_handler3
strrchr
strncpy
atoi
printf
strncmp
sprintf
_errno
wcscpy
_snprintf
strncat
realloc
fopen
rand
srand
time
fclose
fputs
_beginthreadex
calloc
??1type_info@@UAE@XZ
__dllonexit
_onexit
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
strlen
memmove
__CxxFrameHandler
??3@YAXPAX@Z
??2@YAPAXI@Z
_strrev
_strnicmp
_strupr
_strcmpi
??0exception@@QAE@ABV0@@Z
memcpy
netapi32
NetLocalGroupAddMembers
NetUserAdd
avicap32
capGetDriverDescriptionA
capCreateCaptureWindowA
Sections
.text Size: 99KB - Virtual size: 98KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 16KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 13KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ