Behavioral task
behavioral1
Sample
688c8887abf7db758622e6008d02a75d_JaffaCakes118.dll
Resource
win7-20240705-en
General
-
Target
688c8887abf7db758622e6008d02a75d_JaffaCakes118
-
Size
105KB
-
MD5
688c8887abf7db758622e6008d02a75d
-
SHA1
7c670b70019f6ba356b26e6bcc44747f2b3ab41f
-
SHA256
c552f7bf3fbe21b227362c7350b5862d61a6f59bf409425cf1067f274b6aec83
-
SHA512
a31951e90bfd0ecb5120ff6e8459fe7df7a704bb37c3bbbdff137e30d92e8b0782e8f485b84a407739c26f5bf73fb7565881ce7645725302278c23e094a25b2f
-
SSDEEP
3072:Hgt4gweDudIR+TzMCmxSoDEdaTxPklTw+jZoHuwC:O4gweadIR+nB0OdQ5qw+9oI
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
Files
-
688c8887abf7db758622e6008d02a75d_JaffaCakes118.dll windows:4 windows x86 arch:x86
Code Sign
f3:f8:0c:0c:fe:f4:48:fb:a3:e3:82:9a:2d:b2:3e:72:0d:73:23:b3Signer
Actual PE Digestf3:f8:0c:0c:fe:f4:48:fb:a3:e3:82:9a:2d:b2:3e:72:0d:73:23:b3Digest Algorithmsha1PE Digest MatchesfalseHeaders
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Exports
Exports
ServiceMain
Sections
.text Size: 88KB - Virtual size: 87KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 960B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.Silvana Size: 661B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
afds Size: 512B - Virtual size: 512B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE