Overview

overview

10

Static

static

3

74a0fb0e3f...18.exe

windows7-x64

10

74a0fb0e3f...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    74a0fb0e3ff8e93bf23b54818a5fda46_JaffaCakes118

  • Size

    192KB

  • Sample

    240726-swmfvawdpr

  • MD5

    74a0fb0e3ff8e93bf23b54818a5fda46

  • SHA1

    706d44eb508ca1c4121459c1da8d328b98fa0e2b

  • SHA256

    7351f766fb6d17f01154cea240704b351bc76a34108d3238b330d7a5bb0e1156

  • SHA512

    4bfae519dccbbdbb9c9e571df61b3683d0fde5b3b1f063f323446644bcd474c80127c1445bebf262006fb236ccfbc8de384adac8fe683b8fb3146f4531554b3f

  • SSDEEP

    3072:KhqLTH1JnWVch96O6V/Qk2WKdwQH/hnSI5+ulG3K97q7cOh3TS3y87wxqK/lGAOs:BfXnWVcKRzQdvHn3K/lGAONx3

Score
10/10
gh0stratbootkitdiscoverypersistencerat

Malware Config

Targets

    • Target

      74a0fb0e3ff8e93bf23b54818a5fda46_JaffaCakes118

    • Size

      192KB

    • MD5

      74a0fb0e3ff8e93bf23b54818a5fda46

    • SHA1

      706d44eb508ca1c4121459c1da8d328b98fa0e2b

    • SHA256

      7351f766fb6d17f01154cea240704b351bc76a34108d3238b330d7a5bb0e1156

    • SHA512

      4bfae519dccbbdbb9c9e571df61b3683d0fde5b3b1f063f323446644bcd474c80127c1445bebf262006fb236ccfbc8de384adac8fe683b8fb3146f4531554b3f

    • SSDEEP

      3072:KhqLTH1JnWVch96O6V/Qk2WKdwQH/hnSI5+ulG3K97q7cOh3TS3y87wxqK/lGAOs:BfXnWVcKRzQdvHn3K/lGAONx3

    Score
    10/10
    gh0stratbootkitdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks