Overview

overview

10

Static

static

1

6238248193...18.exe

windows7-x64

10

6238248193...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    6238248193d517c391f12e1ba250649d_JaffaCakes118

  • Size

    95KB

  • Sample

    240722-bq8y8athrd

  • MD5

    6238248193d517c391f12e1ba250649d

  • SHA1

    fd6ab02c7b33e14f447a0d682a247c44f453aa37

  • SHA256

    1cf8ed7e395da8d9976019ae6d8eadc52a797b2d32b56ec37381e84812d8372b

  • SHA512

    58b078f3b23bc754df6a20294712db7875d12659446913d391a068bcf831bfae8227189bf0c20fa93e5e01475262239505458fe8363bb8a547ac9c6b9b950d79

  • SSDEEP

    1536:SYFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prFm2d11o:SKS4jHS8q/3nTzePCwNUh4E9Fm2d11o

Score
10/10
gh0stratbootkitpersistencerat

Malware Config

Targets

    • Target

      6238248193d517c391f12e1ba250649d_JaffaCakes118

    • Size

      95KB

    • MD5

      6238248193d517c391f12e1ba250649d

    • SHA1

      fd6ab02c7b33e14f447a0d682a247c44f453aa37

    • SHA256

      1cf8ed7e395da8d9976019ae6d8eadc52a797b2d32b56ec37381e84812d8372b

    • SHA512

      58b078f3b23bc754df6a20294712db7875d12659446913d391a068bcf831bfae8227189bf0c20fa93e5e01475262239505458fe8363bb8a547ac9c6b9b950d79

    • SSDEEP

      1536:SYFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prFm2d11o:SKS4jHS8q/3nTzePCwNUh4E9Fm2d11o

    Score
    10/10
    gh0stratbootkitpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks