Overview

overview

10

Static

static

3

95495ab40b...18.exe

windows7-x64

10

95495ab40b...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    95495ab40b2a3681cc9e12a2caf41fd2_JaffaCakes118

  • Size

    2.9MB

  • Sample

    240814-j4tqfswgmj

  • MD5

    95495ab40b2a3681cc9e12a2caf41fd2

  • SHA1

    be5a2a5c8c4d6f5bc410da39263ceb5510a70306

  • SHA256

    44ce754a89cb346d14b8fe7ba938c8ff2b5e0bb845d0cd745b56dbda2ce2b258

  • SHA512

    d81112e20cf29bc3147d2335cd78e2fbc7ec453965001c6589f4bb744db09b7b71c16011bebf3591a6587361b31c40c8a0b625cc77b3b04e469dd4a2c59cfc42

  • SSDEEP

    49152:v3B/3YSLJrYAAowkRKIQnGjPAR2kZwgQE4gQARVH/uKXXqYOnCDTj:/F3jLJrYoF2GjwB1+1Cr

Score
10/10
gh0strataspackv2discoverypersistencerat

Malware Config

Targets

    • Target

      95495ab40b2a3681cc9e12a2caf41fd2_JaffaCakes118

    • Size

      2.9MB

    • MD5

      95495ab40b2a3681cc9e12a2caf41fd2

    • SHA1

      be5a2a5c8c4d6f5bc410da39263ceb5510a70306

    • SHA256

      44ce754a89cb346d14b8fe7ba938c8ff2b5e0bb845d0cd745b56dbda2ce2b258

    • SHA512

      d81112e20cf29bc3147d2335cd78e2fbc7ec453965001c6589f4bb744db09b7b71c16011bebf3591a6587361b31c40c8a0b625cc77b3b04e469dd4a2c59cfc42

    • SSDEEP

      49152:v3B/3YSLJrYAAowkRKIQnGjPAR2kZwgQE4gQARVH/uKXXqYOnCDTj:/F3jLJrYoF2GjwB1+1Cr

    Score
    10/10
    gh0strataspackv2discoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • ASPack v2.12-2.42

      Detects executables packed with ASPack v2.12-2.42

      aspackv2

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks