Overview

overview

10

Static

static

3

42e18a34dc...18.exe

windows7-x64

10

42e18a34dc...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    42e18a34dcf7cbedcfa164c4537fa06b_JaffaCakes118

  • Size

    96KB

  • Sample

    240713-xbn66avdjd

  • MD5

    42e18a34dcf7cbedcfa164c4537fa06b

  • SHA1

    3134e9a7146b3cf7d109415cecb86fb66f8c9589

  • SHA256

    941d73e6897bfb069edcad6d0f9ad91c4b8ab1552299495bb9dee2cf5c316cb0

  • SHA512

    7974879107850a03fe1e39f5f884ea90584956a9a95820531438390a16c6428463bc91aa55500af73c0456c5a9191fc16da3bb128a4cf5b1fac3fb7c912d1e5d

  • SSDEEP

    3072:C+S4jHS8q/3nTzePCwNUh4E92HmuLAUSmM:Cx428q/nTzePCwG7cmg2

Score
10/10
gh0stratbootkitpersistencerat

Malware Config

Targets

    • Target

      42e18a34dcf7cbedcfa164c4537fa06b_JaffaCakes118

    • Size

      96KB

    • MD5

      42e18a34dcf7cbedcfa164c4537fa06b

    • SHA1

      3134e9a7146b3cf7d109415cecb86fb66f8c9589

    • SHA256

      941d73e6897bfb069edcad6d0f9ad91c4b8ab1552299495bb9dee2cf5c316cb0

    • SHA512

      7974879107850a03fe1e39f5f884ea90584956a9a95820531438390a16c6428463bc91aa55500af73c0456c5a9191fc16da3bb128a4cf5b1fac3fb7c912d1e5d

    • SSDEEP

      3072:C+S4jHS8q/3nTzePCwNUh4E92HmuLAUSmM:Cx428q/nTzePCwG7cmg2

    Score
    10/10
    gh0stratbootkitpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks