Behavioral task
behavioral1
Sample
8380d8ea5a1fd00325a2f792f97b1f0c_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
8380d8ea5a1fd00325a2f792f97b1f0c_JaffaCakes118
-
Size
151KB
-
MD5
8380d8ea5a1fd00325a2f792f97b1f0c
-
SHA1
7f707fa3c69bf887594f256f83f080fc9fb3da3a
-
SHA256
48b115438cfcb0e8670add735d3698c5b5759f628dc64b2a9879228daf6c62ec
-
SHA512
c135f23e6398e7e31edd23e63d5315395709cd22a193f889bdcb1eb2377991374fc665c2e596ecba0f012e0c2d5c31e2e2a54b8c0e33fab12aaf32e8f9ed6c11
-
SSDEEP
3072:0PBz5C9qblUloHkRz9Vg6cBLGKip8Fk6k4DSeaC5J:0PooH+5IoK2Gjk4OL2
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8380d8ea5a1fd00325a2f792f97b1f0c_JaffaCakes118
Files
-
8380d8ea5a1fd00325a2f792f97b1f0c_JaffaCakes118.exe windows:4 windows x86 arch:x86
16e6c502bf4c3b967c7ad8ada94ce3f7
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
FreeResource
Sleep
WriteFile
CreateFileA
DeleteFileA
SizeofResource
LockResource
LoadResource
FindResourceA
GetModuleFileNameA
WaitForSingleObject
CreateEventA
GetProcAddress
LoadLibraryA
GetWindowsDirectoryA
GetTickCount
WinExec
GetModuleHandleA
GetLastError
RaiseException
GetStartupInfoA
InterlockedExchange
LocalAlloc
FreeLibrary
msvcrt
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
__getmainargs
_acmdln
exit
_exit
srand
rand
sprintf
_XcptFilter
Sections
.text Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 372B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 145KB - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ