Behavioral task
behavioral1
Sample
7184ab059996a9d4541f26be86cb4b6d_JaffaCakes118.exe
Resource
win7-20240708-en
General
-
Target
7184ab059996a9d4541f26be86cb4b6d_JaffaCakes118
-
Size
152KB
-
MD5
7184ab059996a9d4541f26be86cb4b6d
-
SHA1
7141d3a6f495e17e0911cce0d95c92003b920878
-
SHA256
afd3a98b5e2f09931bdb69a73cf140297d72da3db8652632a487a6c692ee78ac
-
SHA512
3e08e489e6e39689e4849e82efad2874a728b09a90c624a0abaa13acd5eedfd801b4baab5554ebf12251a97cf822ac203f64ae5e02ac8cf7d66dd154215ec0ff
-
SSDEEP
3072:TTOnGzUxsglrtfhKoAFd0SD9a2lC9hH+QJ9nUG/5ZCwd8J:TTOnGAxs+fhZAFd5i9hzJ9p/5ZCwW
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7184ab059996a9d4541f26be86cb4b6d_JaffaCakes118
Files
-
7184ab059996a9d4541f26be86cb4b6d_JaffaCakes118.exe windows:4 windows x86 arch:x86
0c67b7059ece060b245afd1b6ecf711d
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetTempPathA
lstrcpyA
lstrcmpiA
SetLastError
GetFileAttributesA
ReadFile
SetFilePointer
GetModuleFileNameA
Sleep
SetUnhandledExceptionFilter
CopyFileA
ReleaseMutex
CreateMutexA
GetLocalTime
FindClose
GetTickCount
FindFirstFileA
GetCommandLineA
GetCurrentThreadId
GetStringTypeA
LCMapStringW
LCMapStringA
GetOEMCP
GetACP
GetCPInfo
IsBadCodePtr
IsBadReadPtr
GetFileType
GetStdHandle
FindResourceA
LoadResource
CreateFileA
SystemTimeToFileTime
LocalFileTimeToFileTime
OpenProcess
SetFileTime
SizeofResource
WriteFile
lstrlenA
FreeResource
MoveFileA
SetFileAttributesA
DeleteFileA
WideCharToMultiByte
GetSystemDirectoryA
MultiByteToWideChar
LoadLibraryA
OutputDebugStringA
FreeLibrary
GetCurrentProcess
CreateToolhelp32Snapshot
Process32First
Process32Next
ExitProcess
lstrcatA
GetLastError
GetProcessHeap
HeapAlloc
GetModuleHandleA
GetProcAddress
HeapFree
TerminateProcess
CloseHandle
WinExec
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
FreeEnvironmentStringsA
UnhandledExceptionFilter
HeapCreate
HeapDestroy
GetVersionExA
GetEnvironmentVariableA
RtlUnwind
HeapReAlloc
RaiseException
GetStartupInfoA
GetVersion
HeapSize
VirtualFree
VirtualAlloc
IsBadWritePtr
GetStringTypeW
user32
GetInputState
PostThreadMessageA
GetMessageA
wsprintfA
LoadIconA
advapi32
GetAce
OpenServiceA
StartServiceA
OpenSCManagerA
CreateServiceA
CloseServiceHandle
GetUserNameA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
LookupAccountNameA
GetFileSecurityA
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetAclInformation
GetLengthSid
InitializeAcl
AddAce
EqualSid
AddAccessAllowedAce
SetSecurityDescriptorDacl
GetSecurityDescriptorControl
SetFileSecurityA
netapi32
NetApiBufferFree
NetUserGetLocalGroups
Sections
.text Size: 42KB - Virtual size: 42KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 108KB - Virtual size: 108KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ