gh0strat

General

Target

94bda1bbecf8314ccb0b7cac3bda7217_JaffaCakes118
Size

139KB
Sample

240813-zy7m5awemf
MD5

94bda1bbecf8314ccb0b7cac3bda7217
SHA1

d093a5ebf9d5c5f04d19e35d8a2f79bb1ea8f12e
SHA256

42028110d6e1320e031446bbdc585acb94a0c0147875a9dfc14c52f85792d5d9
SHA512

33c47d6f9aa7708586e7afe8e9ddf10a3db701100e120cae57184cd665c9afc961182fa914fae36db2404b85afafe4542383f90e0acc94b2c76294628efda48f
SSDEEP

3072:IVpbSWgMqqDa/QdMm97LHmfQJMtPVFS933s4tEtNiUe2jzWfg:kuIqqDGQd9/HmW6OgNiUBjCfg

Score

10^/10

Malware Config

Targets

- Target
  
  94bda1bbecf8314ccb0b7cac3bda7217_JaffaCakes118
- Size
  
  139KB
- MD5
  
  94bda1bbecf8314ccb0b7cac3bda7217
- SHA1
  
  d093a5ebf9d5c5f04d19e35d8a2f79bb1ea8f12e
- SHA256
  
  42028110d6e1320e031446bbdc585acb94a0c0147875a9dfc14c52f85792d5d9
- SHA512
  
  33c47d6f9aa7708586e7afe8e9ddf10a3db701100e120cae57184cd665c9afc961182fa914fae36db2404b85afafe4542383f90e0acc94b2c76294628efda48f
- SSDEEP
  
  3072:IVpbSWgMqqDa/QdMm97LHmfQJMtPVFS933s4tEtNiUe2jzWfg:kuIqqDGQd9/HmW6OgNiUBjCfg
Score

10^/10

gh0strat discovery persistence rat
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Drops file in Drivers directory
- Server Software Component: Terminal Services DLL
  persistence
- Deletes itself
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

1

T1505

Terminal Services DLL

1

T1505.005

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Gh0st RAT payload

Drops file in Drivers directory

Server Software Component: Terminal Services DLL

Deletes itself

Loads dropped DLL

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2