gh0strat | 8d5069c0c9ffefae4177c5262584d8fc_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

8d5069c0c9ffefae4177c5262584d8fc_JaffaCakes118
Size

148KB
MD5

8d5069c0c9ffefae4177c5262584d8fc
SHA1

ccb19681d173195676ac4d3c40f3df0de308dd7e
SHA256

49d3775ea06164d32aa7d6f695981cff45c770a1ce228d869583ad0a89ea0cf7
SHA512

99809cbc023a4277d5d78b15bc2c7f4873493974cad63c184cc6a3e1d361676e7a6f29b04c5c40bfcb5340d9ab456a837837a1ea2e050f436e18c69c73eac746
SSDEEP

3072:2vKVnPGwBSkLjq+LA2tcLh7TyjoOaZTBftnL6p+pvd:L9PGo3jS+aXOaZTBlnLjNd

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8d5069c0c9ffefae4177c5262584d8fc_JaffaCakes118

Files

8d5069c0c9ffefae4177c5262584d8fc_JaffaCakes118
.dll windows:4 windows x86 arch:x86

23d7a7a929b439a945b30eabb5aec30c

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

user32

ShowWindow
LoadCursorA
DestroyCursor
GetCursorInfo
wvsprintfA
CloseWindowStation
CreateWindowExA
DestroyWindow
MessageBoxA
wsprintfA

kernel32

CreateFileMappingA
RaiseException
VirtualAlloc
VirtualFree
InterlockedIncrement
InterlockedDecrement
IsBadStringPtrW
IsBadReadPtr
ExitThread
CloseHandle
lstrcmpiA
lstrcpyA
GetVersionExA
GetCurrentThreadId
GetProcAddress
GetTickCount
Sleep
GetTempFileNameA
lstrcatA
lstrlenA
GetModuleHandleA
ExpandEnvironmentStringsA
GetLastError
LocalFree
LocalReAlloc
LocalAlloc
VirtualQuery
GetCurrentProcessId
VirtualProtect
GetSystemDirectoryA
MultiByteToWideChar
SetEnvironmentVariableA
GetTempPathA
GetLongPathNameA
GetModuleFileNameA
ExitProcess
GetExitCodeProcess
FreeLibrary
WideCharToMultiByte
lstrcmpA
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
LocalSize
InitializeCriticalSection
InterlockedExchange
LeaveCriticalSection
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GetLocalTime
HeapFree
GetProcessHeap
MapViewOfFile
LoadLibraryA
GetShortPathNameA
HeapAlloc
SetUnhandledExceptionFilter
FormatMessageA
IsBadWritePtr
GetSystemInfo
GetProcessTimes
GetCurrentProcess
GlobalMemoryStatusEx
DeleteFileA
RemoveDirectoryA

msvcrt

strncpy
_adjust_fdiv
_initterm
_onexit
__dllonexit
??1type_info@@UAE@XZ
_wcsicmp
_memicmp
__CxxFrameHandler
_beginthreadex
??3@YAXPAX@Z
??2@YAPAXI@Z
_except_handler3
strrchr
malloc
strstr
strchr
free
rand
srand
_ftol
_strupr
_CxxThrowException
wcsrchr
atoi
wcstombs
strncat
memmove
ceil
wcslen
_strlwr

Exports

Exports

DllRegister

Sections

.text
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

23d7a7a929b439a945b30eabb5aec30c

Headers

File Characteristics

Imports

user32

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 96KB - Virtual size: 95KB

.rdata Size: 24KB - Virtual size: 20KB

.data Size: 12KB - Virtual size: 16KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 96KB - Virtual size: 95KB

.rdata
Size: 24KB - Virtual size: 20KB

.data
Size: 12KB - Virtual size: 16KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 8KB - Virtual size: 7KB