Overview

overview

10

Static

static

1

6adc5df7d5...18.exe

windows7-x64

10

6adc5df7d5...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    6adc5df7d54238d5ddc05a0ce543bb5c_JaffaCakes118

  • Size

    95KB

  • Sample

    240724-jzqs1awcpr

  • MD5

    6adc5df7d54238d5ddc05a0ce543bb5c

  • SHA1

    ca611161df169877520b19255a0274c7ce1403cb

  • SHA256

    832c1276b995f107747a2c6577dff77974c4deb519868431823b8a5c71b9ace6

  • SHA512

    d60d3b8503d035e8499959df9d8065470cdc00c1ee7342fc11c36f00d92364b9c940f53328d571ef6e7269fa0e6ca8f4ceb4239cef0287ea7e4bd8a6d8554442

  • SSDEEP

    1536:10FusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prcZQ4Jkw:1GS4jHS8q/3nTzePCwNUh4E9Hxw

Score
10/10
gh0stratbootkitdiscoverypersistencerat

Malware Config

Targets

    • Target

      6adc5df7d54238d5ddc05a0ce543bb5c_JaffaCakes118

    • Size

      95KB

    • MD5

      6adc5df7d54238d5ddc05a0ce543bb5c

    • SHA1

      ca611161df169877520b19255a0274c7ce1403cb

    • SHA256

      832c1276b995f107747a2c6577dff77974c4deb519868431823b8a5c71b9ace6

    • SHA512

      d60d3b8503d035e8499959df9d8065470cdc00c1ee7342fc11c36f00d92364b9c940f53328d571ef6e7269fa0e6ca8f4ceb4239cef0287ea7e4bd8a6d8554442

    • SSDEEP

      1536:10FusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prcZQ4Jkw:1GS4jHS8q/3nTzePCwNUh4E9Hxw

    Score
    10/10
    gh0stratbootkitdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks