Behavioral task
behavioral1
Sample
83dc2d50e30f708143bb380cc9419a1e_JaffaCakes118.exe
Resource
win7-20240704-en
General
-
Target
83dc2d50e30f708143bb380cc9419a1e_JaffaCakes118
-
Size
253KB
-
MD5
83dc2d50e30f708143bb380cc9419a1e
-
SHA1
9d62f2b1fc7896fc753b55d0939e7812b9031b49
-
SHA256
7795dc8e20632a7608dc676815a876cacb982ffc087cd242e122580471d5a79c
-
SHA512
7e16cd3155a09c55ade4c957baae07ab3b4d62a698f4e8e0cfd4adea1109f7a128354389ed6c1b3ab844e7d2457d211ac201f1d50ddf0a2799e8bcfb2a2bbb64
-
SSDEEP
3072:oit+tIxCt0dPhgfBWHWVKhqvEzO/V1VrNYQkCA+HFSWvF3TBftXnob2V:nD5QWHA9DNYtEHhvF3TBlXnob
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 83dc2d50e30f708143bb380cc9419a1e_JaffaCakes118
Files
-
83dc2d50e30f708143bb380cc9419a1e_JaffaCakes118.exe windows:4 windows x86 arch:x86
edada803b25662af6e5310b95af49338
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitProcess
lstrcatA
lstrcpyA
GetModuleFileNameA
DeleteFileA
EndUpdateResourceA
UpdateResourceA
BeginUpdateResourceA
ReadFile
GetFileSize
MoveFileA
WritePrivateProfileStringA
lstrlenA
SetFilePointer
Sleep
CloseHandle
WriteFile
CreateFileA
LoadResource
SizeofResource
FindResourceA
GetLocalTime
WinExec
GetCurrentThreadId
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
SetStdHandle
LoadLibraryA
GetProcAddress
GetOEMCP
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
GetLastError
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
FlushFileBuffers
user32
wsprintfA
GetMessageA
PostThreadMessageA
GetInputState
ole32
CoCreateGuid
CoInitialize
CoUninitialize
Sections
.text Size: 20KB - Virtual size: 20KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 12KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 212KB - Virtual size: 212KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 4KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE