Overview

overview

10

Static

static

10

a3961563d3...18.exe

windows7-x64

10

a3961563d3...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    a3961563d31db48bec0fc188a76b2568_JaffaCakes118

  • Size

    174KB

  • Sample

    240817-wr81tssbpr

  • MD5

    a3961563d31db48bec0fc188a76b2568

  • SHA1

    5a167d9f348abf0d47d17173bf96095b34173d0e

  • SHA256

    3af3127e1a2b395fe1aa931e74fb38523494475a527e872be5fc1ae2fe7f4b65

  • SHA512

    acb2cf2b2e3fe96608b0a8d9d75dd78af7ce584fc3738102e0d7c3a20565ca76f5d2c1247b185c95a4661ec0840eccd0b2a1e14174dfd62ed46cd02a12d72356

  • SSDEEP

    3072:VJuGnYhTbK80khbOW1oWOQ1f9xHwm1PXBmXZFeA28pM6EdePl9dehiv80P80CnpZ:VJueTk1OwoWOQ3dwaWB28edeP/deUv8M

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      a3961563d31db48bec0fc188a76b2568_JaffaCakes118

    • Size

      174KB

    • MD5

      a3961563d31db48bec0fc188a76b2568

    • SHA1

      5a167d9f348abf0d47d17173bf96095b34173d0e

    • SHA256

      3af3127e1a2b395fe1aa931e74fb38523494475a527e872be5fc1ae2fe7f4b65

    • SHA512

      acb2cf2b2e3fe96608b0a8d9d75dd78af7ce584fc3738102e0d7c3a20565ca76f5d2c1247b185c95a4661ec0840eccd0b2a1e14174dfd62ed46cd02a12d72356

    • SSDEEP

      3072:VJuGnYhTbK80khbOW1oWOQ1f9xHwm1PXBmXZFeA28pM6EdePl9dehiv80P80CnpZ:VJueTk1OwoWOQ3dwaWB28edeP/deUv8M

    Score
    10/10
    gh0stratdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks