Behavioral task
behavioral1
Sample
8974fa10f36f427d0c37bc58816a6ff4_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8974fa10f36f427d0c37bc58816a6ff4_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8974fa10f36f427d0c37bc58816a6ff4_JaffaCakes118
-
Size
41KB
-
MD5
8974fa10f36f427d0c37bc58816a6ff4
-
SHA1
c38d8f7884675331a897cdc3c44fe6201ce107a5
-
SHA256
15ed609b134273a6a5b2b5f308b288860f4f0ac8148dc6de2f4dffe62b4dbcdd
-
SHA512
f94d322922515d3edcd60f6ad2c223f9c26b15cdf076f6be915a0ea9634ef675ce3b973f3b9b564e5d325026c415a4347f2ec156e2dc092739dbdc782c5fcf07
-
SSDEEP
768:QNKyPztQrfkvLWq+4v/3vH12CkD6sZCS7069WvVJonW1z:QNhPyDkvxvvvHMDRr9WNWSz
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8974fa10f36f427d0c37bc58816a6ff4_JaffaCakes118
Files
-
8974fa10f36f427d0c37bc58816a6ff4_JaffaCakes118.exe windows:4 windows x86 arch:x86
75d61307d958a16545fea1a5115eac98
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
CloseServiceHandle
StartServiceA
OpenServiceA
OpenSCManagerA
CreateServiceA
RegQueryValueExA
user32
wsprintfA
msvcrt
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
strstr
strchr
??2@YAPAXI@Z
??3@YAXPAX@Z
_except_handler3
malloc
realloc
_controlfp
kernel32
GetStartupInfoA
SetLastError
lstrcpyA
GetTempPathA
GetTickCount
MoveFileA
SetFileAttributesA
DeleteFileA
GetCommandLineA
CreateMutexA
GetLastError
ReleaseMutex
Sleep
GetWindowsDirectoryA
lstrcatA
GetFileAttributesA
CreateDirectoryA
WinExec
lstrlenA
ExitProcess
GetModuleHandleA
FindResourceA
LoadResource
CloseHandle
GetCurrentProcess
ReadFile
SetFilePointer
CreateFileA
GetModuleFileNameA
FreeResource
WriteFile
SizeofResource
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
Sections
.text Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 138KB - Virtual size: 137KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ