Behavioral task
behavioral1
Sample
a46d932ed60571d4db1359e5ebb94024_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
a46d932ed60571d4db1359e5ebb94024_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a46d932ed60571d4db1359e5ebb94024_JaffaCakes118
-
Size
129KB
-
MD5
a46d932ed60571d4db1359e5ebb94024
-
SHA1
2bc9590594d87353c4121e858b38bbf774a1c1d1
-
SHA256
e1f0ca6dd460abd040923e78f5c4a3d22c70a255f289bf7e9fffbf4b7894baf8
-
SHA512
7e055d012341e74c8265eec9c423bcba11027bff4918edf9f326096b700f23d7f450f9e5ff2f06e3032ea5203d6fe2653486b0a03f5871307f314cad47d78d28
-
SSDEEP
3072:utSvejLfvhmjAR8nfT7PK/flHMareAcOCPRazEhyz7U/pp3:YSmjjvhmjnHC/fWZA7VzEhyU/L
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a46d932ed60571d4db1359e5ebb94024_JaffaCakes118
Files
-
a46d932ed60571d4db1359e5ebb94024_JaffaCakes118.exe windows:4 windows x86 arch:x86
04e7562c2c637263efab8b88c91750ef
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLocalTime
Sleep
GetTempPathA
SetUnhandledExceptionFilter
ReleaseMutex
CreateMutexA
GetCommandLineA
GetModuleFileNameA
CreateDirectoryA
GetSystemDirectoryA
GetCurrentThreadId
GetStartupInfoA
GetModuleHandleA
SetFilePointer
ReadFile
DeleteFileA
GetFileAttributesA
GetLastError
SetLastError
lstrcmpiA
lstrcpyA
LoadResource
CreateFileA
SizeofResource
lstrlenA
CloseHandle
ExitProcess
GetWindowsDirectoryA
LoadLibraryA
GetProcAddress
FreeLibrary
lstrcatA
SetFileAttributesA
user32
GetWindow
GetTopWindow
GetDesktopWindow
GetMessageA
PostThreadMessageA
GetClassNameA
wsprintfA
GetInputState
advapi32
RegDeleteKeyA
RegDeleteValueA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
RegCreateKeyExA
CloseServiceHandle
CreateServiceA
OpenSCManagerA
StartServiceA
OpenServiceA
RegSetValueExA
shell32
ShellExecuteA
msvcrt
??1type_info@@UAE@XZ
_controlfp
__set_app_type
__p__fmode
__p__commode
realloc
malloc
_except_handler3
strchr
strtok
??2@YAPAXI@Z
__CxxFrameHandler
_CxxThrowException
??3@YAXPAX@Z
strstr
_stricmp
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 119KB - Virtual size: 119KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ