Behavioral task
behavioral1
Sample
6f595df90dddd9a75d5f0b0e6d8cceb8_JaffaCakes118.dll
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6f595df90dddd9a75d5f0b0e6d8cceb8_JaffaCakes118.dll
Resource
win10v2004-20240709-en
General
-
Target
6f595df90dddd9a75d5f0b0e6d8cceb8_JaffaCakes118
-
Size
104KB
-
MD5
6f595df90dddd9a75d5f0b0e6d8cceb8
-
SHA1
dca3c5887abfeb769cfbd4e1b786f274aa60a79a
-
SHA256
e8c1fdc54fab77f510eee587a81b40fcf95fa358ec3432a57d4c7da7ce3fd9f2
-
SHA512
664074c38095315091165f0e692487a73d465594ef430f6fa5db904df2e28a2c9521ff171883171630ade388582336216424d85a39ffebf3f5ce0b75d8406ef5
-
SSDEEP
1536:E0Bq3fthxo0IdSgb8Bb5165VuRci/rPfBiEQ72mw7uKPpcDs:VBOTI8h7UVuRh/DBiEQcaKPpcDs
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 6f595df90dddd9a75d5f0b0e6d8cceb8_JaffaCakes118
Files
-
6f595df90dddd9a75d5f0b0e6d8cceb8_JaffaCakes118.dll windows:6 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
Size: 73KB - Virtual size: 43KB
Size: 128KB - Virtual size: 4B
���� Size: 89KB - Virtual size:
IMAGE_SCN_CNT_INITIALIZED_DATA
Size: 120KB - Virtual size:
Size: - Virtual size:
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA