Behavioral task
behavioral1
Sample
8bfd213852cedfecef30b64698ad5f81_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
8bfd213852cedfecef30b64698ad5f81_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
8bfd213852cedfecef30b64698ad5f81_JaffaCakes118
-
Size
150KB
-
MD5
8bfd213852cedfecef30b64698ad5f81
-
SHA1
f4d13dff6bffbc7e41bcfe148c9cdfeeff076d5d
-
SHA256
7709c17fa437bda269aa14dff486408c1f847cddc818b7b6d3b52b9c9e1d5dac
-
SHA512
6669983396c03b748e8790c82ba88af9ffcac7c5c14b47a51a830ba006e6d19e64647ded5f76755cb6f1825272ceda27004dc672f091231587a83a1ce5d1fb8c
-
SSDEEP
3072:Kxzq40FKrXrP1LCYHdCpYPpxVFMS9FM6cAVGlzu0aETT6:K9Jr7P1xCpYPDcS79cAVgzu0aEC
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8bfd213852cedfecef30b64698ad5f81_JaffaCakes118
Files
-
8bfd213852cedfecef30b64698ad5f81_JaffaCakes118.exe windows:4 windows x86 arch:x86
1727fc1b96d5010a87d8cad105665de9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
Process32Next
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
FreeResource
lstrlenA
GetLocalTime
GetTickCount
WriteFile
SizeofResource
CreateFileA
LoadResource
FindResourceA
GetModuleHandleA
MoveFileA
ExitProcess
WinExec
lstrcatA
lstrcpyA
GetModuleFileNameA
DeleteFileA
GetSystemDirectoryA
CopyFileA
Sleep
CreateThread
GetFileAttributesA
GetWindowsDirectoryA
LoadLibraryA
GetLastError
RaiseException
InterlockedExchange
GetProcAddress
FreeLibrary
LocalAlloc
msvcrt
_onexit
__dllonexit
exit
??2@YAPAXI@Z
_strrev
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 736B - Virtual size: 720B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.CRT Size: 32B - Virtual size: 4B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 144KB - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ