Overview

overview

10

Static

static

10

8613eed5da...18.exe

windows7-x64

10

8613eed5da...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    8613eed5da1d47f3dfb63e03a0ebf6cc_JaffaCakes118

  • Size

    889KB

  • Sample

    240810-ptkmpatelh

  • MD5

    8613eed5da1d47f3dfb63e03a0ebf6cc

  • SHA1

    683f6b5d3dfdcdb3a1368cdc4943c784ed19844f

  • SHA256

    7808063157bafdf92c74c6335d492e93eb0366b1a4e8ecca41f4572c1f0f53c7

  • SHA512

    3a028514f0cb9d6f2a6c32a115e353d73930c01a2b34b981d2a0a1705fe5b6885d2dc9583173992af82a1528432c1af2b7c0bd7595f38317d03937bea4908858

  • SSDEEP

    12288:iM5jZKbBL3aKHx5r+TuxX+fWbwFBfdGmZDHANUTNj:iM5j8Z3aKHx5r+TuxX+IwffFZD

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      8613eed5da1d47f3dfb63e03a0ebf6cc_JaffaCakes118

    • Size

      889KB

    • MD5

      8613eed5da1d47f3dfb63e03a0ebf6cc

    • SHA1

      683f6b5d3dfdcdb3a1368cdc4943c784ed19844f

    • SHA256

      7808063157bafdf92c74c6335d492e93eb0366b1a4e8ecca41f4572c1f0f53c7

    • SHA512

      3a028514f0cb9d6f2a6c32a115e353d73930c01a2b34b981d2a0a1705fe5b6885d2dc9583173992af82a1528432c1af2b7c0bd7595f38317d03937bea4908858

    • SSDEEP

      12288:iM5jZKbBL3aKHx5r+TuxX+fWbwFBfdGmZDHANUTNj:iM5j8Z3aKHx5r+TuxX+IwffFZD

    Score
    10/10
    gh0stratdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks