Behavioral task
behavioral1
Sample
a4e0fe8a7a1bde789b9be3bd30080492_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
a4e0fe8a7a1bde789b9be3bd30080492_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a4e0fe8a7a1bde789b9be3bd30080492_JaffaCakes118
-
Size
252KB
-
MD5
a4e0fe8a7a1bde789b9be3bd30080492
-
SHA1
0fcc0fb518fe9cc3fc0564697e88f007ce580e28
-
SHA256
06c3890e8098b186aaf2df1e665d0aa9d79620a5aed901c28d41125d3174f05b
-
SHA512
fc970b2a23ba76e37665cbd62887c346ccd31e97c11b1f1e2ae9b2a1882abcd24daeffca008ae6e5b407e331ca724b82ce9913c42e6b80da43e10560ca072af3
-
SSDEEP
3072:fqVYtrjsN9NhlcOaeT4WWDQ8AKwirAHVd8RettdHXl7p12Im9DVQuj:SKtnsN9Nvc4DWEEwyyX8ReZX1p12Im
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a4e0fe8a7a1bde789b9be3bd30080492_JaffaCakes118
Files
-
a4e0fe8a7a1bde789b9be3bd30080492_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.tuxt Size: 148KB - Virtual size: 145KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 18KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 44KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 48KB - Virtual size: 46KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.jiao Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE