gh0strat | 5b086f6b1b57a8f3a7097a4439d09670_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

5b086f6b1b57a8f3a7097a4439d09670_JaffaCakes118
Size

152KB
MD5

5b086f6b1b57a8f3a7097a4439d09670
SHA1

be130c6facb894b262a3aba6697fdae4f87e72cd
SHA256

f977cf139e7a71f1380a0e0b6b18f4fbd6da3834c51257e9ad1319240a9a28a3
SHA512

090be62dad4f8f397c68f8520cf9ccea0df78c0388c9b3945482261b3b7bb2431323a60e3824dbb0ed4422376065f0b063e68c04c4b3b11032d4268ff77a2e4b
SSDEEP

3072:4WCFBaad86T/Ko1F915v76RfVJgXTBftLhL5J33Of3:4xBtGUxx7eTgXTBlLh2f

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5b086f6b1b57a8f3a7097a4439d09670_JaffaCakes118

Files

5b086f6b1b57a8f3a7097a4439d09670_JaffaCakes118
.dll windows:4 windows x86 arch:x86

a7d23ecbd70d426e513a113bf6822aa0

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

DestroyCursor
GetCursorInfo
CloseWindowStation
GetClassNameA
GetWindow
ShowWindow
EnableWindow
CreateWindowExA
DestroyWindow
MessageBoxA
wvsprintfA
LoadCursorA
wsprintfA

kernel32

VirtualAlloc
RaiseException
IsBadWritePtr
FormatMessageA
SetUnhandledExceptionFilter
CreateFileMappingA
MapViewOfFile
GetLocalTime
GetPrivateProfileSectionNamesA
GetPrivateProfileStringA
WideCharToMultiByte
InitializeCriticalSection
CloseHandle
GetTickCount
GetLastError
InterlockedExchange
LeaveCriticalSection
Sleep
lstrlenA
VirtualQuery
lstrcatA
GetProcAddress
GetModuleHandleA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
ExitProcess
lstrcpyA
GetSystemDirectoryA
GetExitCodeProcess
ExpandEnvironmentStringsA
LocalFree
LocalReAlloc
LocalAlloc
FreeLibrary
HeapFree
HeapAlloc
GetProcessHeap
GetSystemInfo
GetVersionExA
GetProcessTimes
GetCurrentProcess
GlobalMemoryStatusEx
GetTempFileNameA
GetCurrentProcessId
VirtualFree
DeleteFileA
RemoveDirectoryA
ExitThread
GetShortPathNameA
GetModuleFileNameA
IsBadReadPtr
IsBadStringPtrW
GetCurrentThreadId
LoadLibraryA
GetFileAttributesExA
lstrcmpA
lstrcmpiA
MultiByteToWideChar
SetEnvironmentVariableA
GetTempPathA
GetLongPathNameA
LocalSize

msvcrt

strncat
_adjust_fdiv
_initterm
_onexit
__dllonexit
??1type_info@@UAE@XZ
_memicmp
_stricmp
_strlwr
_wcsicmp
_strupr
__CxxFrameHandler
??3@YAXPAX@Z
strncpy
??2@YAPAXI@Z
_CxxThrowException
_ftol
_except_handler3
strchr
free
malloc
strstr
strrchr
wcsrchr
_beginthreadex
atoi
rand
srand
strtol
wcstombs
realloc
memmove
ceil
wcslen

Exports

Exports

DavFreeUsedDiskSpace
DavGetDiskSpaceUsage
DavGetTheLockOwnerOfTheFile
DllCanUnloadNow
DllGetClassObject
DllMain
NPAddConnection
NPAddConnection3
NPCancelConnection
NPCloseEnum
NPEnumResource
NPFormatNetworkName
NPGetCaps
NPGetConnection
NPGetResourceInformation
NPGetResourceParent
NPGetUniversalName
NPGetUser

Sections

.text
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a7d23ecbd70d426e513a113bf6822aa0

Headers

File Characteristics

Imports

user32

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 100KB - Virtual size: 99KB

.rdata Size: 24KB - Virtual size: 20KB

.data Size: 12KB - Virtual size: 17KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 100KB - Virtual size: 99KB

.rdata
Size: 24KB - Virtual size: 20KB

.data
Size: 12KB - Virtual size: 17KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 8KB - Virtual size: 7KB