gh0strat | 8208f36f647c5decffaa56a2a8141df7_JaffaCakes118

Sharing

Copy URL

Twitter E-mail

General

Target

8208f36f647c5decffaa56a2a8141df7_JaffaCakes118
Size

152KB
MD5

8208f36f647c5decffaa56a2a8141df7
SHA1

0fdba1242ceb4fe65a2f7aae98115c82774b80f1
SHA256

86c654e7b5a16d52df888b1c40bb1f4eb26e7ecbd417fa23ae7595e26948e841
SHA512

42b8cbcbf824a7a89d375f73c73f2bb47547a816e5bac09290fc10bc977bb469ac2336337bb43442e55115104113ea70465ce24fccabc13a78360dd8ada2b4ea
SSDEEP

3072:dHZiUnFs6KGEwoie2AVjqU1s02TBftXdR6gzf6BT7Dm5:d4UFs6KVOe1qAr2TBlXdR6e6k

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8208f36f647c5decffaa56a2a8141df7_JaffaCakes118

Files

8208f36f647c5decffaa56a2a8141df7_JaffaCakes118
.dll windows:4 windows x86 arch:x86

d83182b382f9156dd054afd2232c88ea

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrcpyA
lstrlenA
Sleep
CloseHandle
GetLastError
GetCurrentThreadId
lstrcmpiA
GetTempFileNameA
lstrcatA
HeapFree
HeapAlloc
GetProcessHeap
GetSystemInfo
GetVersionExA
GetProcessTimes
GetCurrentProcess
GlobalMemoryStatusEx
FreeLibrary
GlobalFree
GlobalAlloc
GetProcAddress
GetModuleHandleA
GetSystemDirectoryA
GetTickCount
DeleteFileA
RemoveDirectoryA
ExitThread
GetModuleFileNameA
IsBadReadPtr
IsBadStringPtrW
InitializeCriticalSection
InterlockedExchange
LeaveCriticalSection
VirtualQuery
ExitProcess
GetExitCodeProcess
VirtualFree
VirtualAlloc
GlobalUnlock
GlobalLock
GlobalSize
SetUnhandledExceptionFilter
GetLocalTime
FormatMessageA
IsBadWritePtr
WideCharToMultiByte
MapViewOfFile
CreateFileMappingA
GetShortPathNameA
LocalFree
LocalAlloc
LocalReAlloc
LocalSize
InterlockedDecrement
InterlockedIncrement
ExpandEnvironmentStringsA
MultiByteToWideChar
lstrcmpA
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
GetCurrentProcessId
SetEnvironmentVariableA
GetTempPathA
GetLongPathNameA
RaiseException
LoadLibraryA

user32

DestroyWindow
wsprintfA
GetWindowRect
ShowWindow
GetWindow
GetClassNameA
GetCursorInfo
DestroyCursor
LoadCursorA
MessageBoxA
CreateWindowExA
wvsprintfA
CloseWindowStation

shlwapi

StrStrIA

oleaut32

SysFreeString

ws2_32

closesocket
__WSAFDIsSet
ioctlsocket
accept
bind
listen
gethostbyname
setsockopt
WSAIoctl
WSACleanup
WSAStartup
gethostname
socket
connect
getsockname
select
recv
send
shutdown

userenv

GetUserProfileDirectoryA
GetProfilesDirectoryA

iphlpapi

GetAdaptersInfo

msvcrt

_wcsicmp
rand
strchr
atoi
strncpy
strstr
malloc
strrchr
??2@YAPAXI@Z
??3@YAXPAX@Z
__CxxFrameHandler
_ftol
wcstombs
_except_handler3
_CxxThrowException
wcsrchr
memmove
_onexit
__dllonexit
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
_strupr
_memicmp
_strlwr
srand
realloc
free
strncat
wcslen
_beginthreadex
ceil

Exports

Exports

BreakRecordsIntoBlob
CombineRecordsInBlob
DnsAcquireContextHandle_A
DnsAcquireContextHandle_W
DnsAllocateRecord
DnsApiAlloc
DnsApiAllocZero
DnsApiFree
DnsApiHeapReset
DnsApiRealloc
DnsApiSetDebugGlobals
DnsAsyncRegisterHostAddrs
DnsAsyncRegisterInit
DnsAsyncRegisterTerm
DnsCopyStringEx
DnsCreateReverseNameStringForIpAddress
DnsCreateStandardDnsNameCopy
DnsCreateStringCopy
DnsDhcpRegisterHostAddrs
DnsDhcpRegisterInit
DnsDhcpRegisterTerm
DnsDhcpRemoveRegistrations
DnsDhcpSrvRegisterHostName
DnsDhcpSrvRegisterInit
DnsDhcpSrvRegisterInitialize
DnsDhcpSrvRegisterTerm
DnsDowncaseDnsNameLabel
DnsExtractRecordsFromMessage_UTF8
DnsExtractRecordsFromMessage_W
DnsFindAuthoritativeZone
DnsFlushResolverCache
DnsFlushResolverCacheEntry_A
DnsFlushResolverCacheEntry_UTF8
DnsFlushResolverCacheEntry_W
DnsFree
DnsFreeConfigStructure
DnsGetBufferLengthForStringCopy
DnsGetCacheDataTable
DnsGetDnsServerList
DnsGetDomainName
DnsGetLastFailedUpdateInfo
DnsGetPrimaryDomainName_A
DnsGlobals
DnsIpv6AddressToString
DnsIpv6StringToAddress
DnsIsAMailboxType
DnsIsStatusRcode
DnsIsStringCountValidForTextType
DnsMapRcodeToStatus
DnsModifyRecordsInSet_A

Sections

.text
Size: 100KB - Virtual size: 97KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 24KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d83182b382f9156dd054afd2232c88ea

Headers

File Characteristics

Imports

kernel32

user32

shlwapi

oleaut32

ws2_32

userenv

iphlpapi

msvcrt

Exports

Exports

Sections

.text Size: 100KB - Virtual size: 97KB

.rdata Size: 24KB - Virtual size: 21KB

.data Size: 12KB - Virtual size: 17KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 100KB - Virtual size: 97KB

.rdata
Size: 24KB - Virtual size: 21KB

.data
Size: 12KB - Virtual size: 17KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 8KB - Virtual size: 7KB