Overview

overview

10

Static

static

3

622348c2db...18.exe

windows7-x64

10

622348c2db...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    622348c2db8431a690a225f3b1141f51_JaffaCakes118

  • Size

    96KB

  • Sample

    240722-badhdatbqe

  • MD5

    622348c2db8431a690a225f3b1141f51

  • SHA1

    4f06a8b01a7384cef1f0a197220465f3d670f1f8

  • SHA256

    2a69fc1ef82d6ef0cc9743bb654936df47386f6792117353a2c34e2c419ac93e

  • SHA512

    97c5ea6aa7fccfa889920a1f14a36ad4d84cfd918035f3887ec7a13d192fec117cc04995c7a29d49057aa3f82a8ac190ee55b3651091cc73328f4bc6071bfed6

  • SSDEEP

    1536:eTFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prGQBmhQGQsWnH:etS4jHS8q/3nTzePCwNUh4E9GQBUSsWH

Score
10/10
gh0stratbootkitpersistencerat

Malware Config

Targets

    • Target

      622348c2db8431a690a225f3b1141f51_JaffaCakes118

    • Size

      96KB

    • MD5

      622348c2db8431a690a225f3b1141f51

    • SHA1

      4f06a8b01a7384cef1f0a197220465f3d670f1f8

    • SHA256

      2a69fc1ef82d6ef0cc9743bb654936df47386f6792117353a2c34e2c419ac93e

    • SHA512

      97c5ea6aa7fccfa889920a1f14a36ad4d84cfd918035f3887ec7a13d192fec117cc04995c7a29d49057aa3f82a8ac190ee55b3651091cc73328f4bc6071bfed6

    • SSDEEP

      1536:eTFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prGQBmhQGQsWnH:etS4jHS8q/3nTzePCwNUh4E9GQBUSsWH

    Score
    10/10
    gh0stratbootkitpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks