gh0strat | a4d8d4739c27514c7f9bf9c9641b4f65_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

a4d8d4739c27514c7f9bf9c9641b4f65_JaffaCakes118
Size

85KB
MD5

a4d8d4739c27514c7f9bf9c9641b4f65
SHA1

6926c0e30dcd00469c3f1850b38e8a40c8fd4dd0
SHA256

d7880815037761c61d3057edb3e5aa5ce35ea0376a77f2862aeb3e7be322af6c
SHA512

f15ab460be7cc79b6fd393e0c1e2fca96ffae5f4ce0e157975826ef8c93c4a668166ac67cdb6e29c229914705b958b08ec1900725affb98063c21c26a85a65bf
SSDEEP

1536:DRiXlZKKHle5iPcl0epfiTMQ1H5vtkHRT35Vg/J:DYKmuiPE0epiTM0H5vtkHRT35uJ

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a4d8d4739c27514c7f9bf9c9641b4f65_JaffaCakes118

Files

a4d8d4739c27514c7f9bf9c9641b4f65_JaffaCakes118
.dll windows:4 windows x86 arch:x86

3798fee3cc64c136b5760f3b091a9293

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

InitializeCriticalSection
DeleteCriticalSection
VirtualFree
LeaveCriticalSection
EnterCriticalSection
VirtualAlloc
CreateEventA
CloseHandle
WaitForSingleObject
ResetEvent
SetEvent
InterlockedExchange
CancelIo
Sleep
DeleteFileA
GetLastError
CreateDirectoryA
GetFileAttributesA
lstrcpyA
lstrlenA
CreateProcessA
lstrcatA
GetDriveTypeA
GetDiskFreeSpaceExA
GetVolumeInformationA
GetLogicalDriveStringsA
FindClose
LocalFree
FindNextFileA
LocalReAlloc
FindFirstFileA
LocalAlloc
RemoveDirectoryA
GetFileSize
CreateFileA
ReadFile
SetFilePointer
WriteFile
MoveFileA
GetModuleFileNameA
SetLastError
GetCurrentProcess
CreateRemoteThread
WriteProcessMemory
VirtualAllocEx
FreeLibrary
GetProcAddress
LoadLibraryA
OpenProcess
TerminateThread
MoveFileExA
GetTickCount
GetSystemDirectoryA
HeapFree
GetProcessHeap
MapViewOfFile
CreateFileMappingA
HeapAlloc
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GetStartupInfoA
CreatePipe
DisconnectNamedPipe
TerminateProcess
PeekNamedPipe
WaitForMultipleObjects
QueryPerformanceCounter
QueryPerformanceFrequency
SetThreadPriority
SetPriorityClass
GetThreadPriority
GetCurrentThread
GetPriorityClass
GetLogicalDrives
GlobalMemoryStatusEx
GetSystemInfo
GetVersionExA
ReleaseMutex
OpenEventA
SetErrorMode
CreateMutexA
SetUnhandledExceptionFilter
FreeConsole
LocalSize
Process32Next
Process32First
CreateToolhelp32Snapshot
lstrcmpiA
GetCurrentThreadId
RaiseException

msvcrt

strncat
strchr
realloc
_CxxThrowException
atoi
atol
wcstombs
strncpy
calloc
??1type_info@@UAE@XZ
_initterm
_adjust_fdiv
strrchr
_except_handler3
malloc
free
??2@YAPAXI@Z
__CxxFrameHandler
strstr
_ftol
ceil
_beginthreadex
memmove
_strnicmp
??3@YAXPAX@Z
_strcmpi

msvcp60

?_Xran@std@@YAXXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB

msvfw32

ICSeqCompressFrame

Exports

Exports

MutiHack

Sections

.Muti
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.text
Size: 36KB - Virtual size: 35KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3798fee3cc64c136b5760f3b091a9293

Headers

File Characteristics

Imports

kernel32

msvcrt

msvcp60

msvfw32

Exports

Exports

Sections

.Muti Size: 22KB - Virtual size: 21KB

.text Size: 36KB - Virtual size: 35KB

.rdata Size: 13KB - Virtual size: 12KB

.data Size: 7KB - Virtual size: 7KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 4KB

.Muti
Size: 22KB - Virtual size: 21KB

.text
Size: 36KB - Virtual size: 35KB

.rdata
Size: 13KB - Virtual size: 12KB

.data
Size: 7KB - Virtual size: 7KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB