Overview

overview

10

Static

static

10

8e437579f2...18.exe

windows7-x64

10

8e437579f2...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8e437579f2d818aa7a9c08dc5502502c_JaffaCakes118

  • Size

    877KB

  • Sample

    240812-ltsrhszdnd

  • MD5

    8e437579f2d818aa7a9c08dc5502502c

  • SHA1

    263579354344755946a5ed5bad32ceee19ea646a

  • SHA256

    93bf582cd43248c840b04205fdb7629fa507cd77fa957a3ce6d916c520ef752f

  • SHA512

    bafac7be842db2644a68b71517aa1a9c65bc7a0e1a7ef0e902ab4ba9139a086a93396caf7b7f9a11d2499a51b0b40983d8843b4044b7ceaeb60d3e11e0e4d32f

  • SSDEEP

    12288:iM5jZKbBL3aKHx5r+TuxX+fWbwFBfdGmZ1:iM5j8Z3aKHx5r+TuxX+IwffFZ1

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      8e437579f2d818aa7a9c08dc5502502c_JaffaCakes118

    • Size

      877KB

    • MD5

      8e437579f2d818aa7a9c08dc5502502c

    • SHA1

      263579354344755946a5ed5bad32ceee19ea646a

    • SHA256

      93bf582cd43248c840b04205fdb7629fa507cd77fa957a3ce6d916c520ef752f

    • SHA512

      bafac7be842db2644a68b71517aa1a9c65bc7a0e1a7ef0e902ab4ba9139a086a93396caf7b7f9a11d2499a51b0b40983d8843b4044b7ceaeb60d3e11e0e4d32f

    • SSDEEP

      12288:iM5jZKbBL3aKHx5r+TuxX+fWbwFBfdGmZ1:iM5j8Z3aKHx5r+TuxX+IwffFZ1

    Score
    10/10
    gh0stratdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks