gh0strat | 93a15cc330e1a6459ff0f8f6eb558350_JaffaCakes118

General

Target

93a15cc330e1a6459ff0f8f6eb558350_JaffaCakes118
Size

136KB
MD5

93a15cc330e1a6459ff0f8f6eb558350
SHA1

6bc96ac50e74d2a1f8c3d856c94653ca11cea8c7
SHA256

d4b67e041fad4cd74e192435127104d3873537b9f4698b6b0a1ecbba9bf60d46
SHA512

ea30f4612acb996357a241ccf5cbe48ba19be95ec50a38af55a20d350d30ee8405dbb670688c654f7e927aed900e036691e137ee317a99a8ea05fb71172eb078
SSDEEP

3072:vV9Dau77uyltApqK2i/qOoxI1Knc7Rr5xtvKlMUJWs:vV9x77uyl2nJ7r1c0Rrp0JWs

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Files

93a15cc330e1a6459ff0f8f6eb558350_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8526bd24198d43e030fbdb0f8d28fc69

Code Sign

Signer

Actual PE Digest

Digest Algorithm

PE Digest Matches

false

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ExitProcess
DeleteFileA
SetFileAttributesA
MoveFileA
CloseHandle
WriteFile
SizeofResource
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
CreateFileA
LoadResource
FindResourceA
lstrcatA
GetTempPathA
lstrcpyA
lstrlenA
lstrcmpiA
SetLastError
GetLastError
GetFileAttributesA
lstrcmpA
GetSystemDirectoryA
Process32Next
Process32First
CreateToolhelp32Snapshot
TerminateProcess
OpenProcess
GetProcAddress
GetModuleHandleA
GetCurrentProcessId
Sleep
GetLocalTime
GetModuleFileNameA
SetUnhandledExceptionFilter
CopyFileA
OutputDebugStringA
SetProcessShutdownParameters
GetStartupInfoA
LoadLibraryA
RaiseException
InterlockedExchange
LocalAlloc
FreeLibrary

msvcrt

??3@YAXPAX@Z
??1type_info@@UAE@XZ
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
strrchr
_CxxThrowException
__CxxFrameHandler
strncpy
strncat
strchr
??2@YAPAXI@Z
_strrev
_stricmp

Exports

Exports

AHBBLMHKABC

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 126KB - Virtual size: 126KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8526bd24198d43e030fbdb0f8d28fc69

Code Sign

Signer

Headers

File Characteristics

Imports

kernel32

msvcrt

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 7KB

.rsrc Size: 126KB - Virtual size: 126KB

.text
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 126KB - Virtual size: 126KB