Behavioral task
behavioral1
Sample
a5f859ece359d5fb2b5541b6d27d5b59_JaffaCakes118.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
a5f859ece359d5fb2b5541b6d27d5b59_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a5f859ece359d5fb2b5541b6d27d5b59_JaffaCakes118
-
Size
136KB
-
MD5
a5f859ece359d5fb2b5541b6d27d5b59
-
SHA1
42f0e72b5ae5bc0ddd100b2e2eabca14f2424c12
-
SHA256
17d8bb7788d88533339b279341cf8611860e8bb17e75e9447e8aab22232118c0
-
SHA512
be04e17549ed92462cc70ac9f23de2fe2371515765979f1c6e4282d593c9349e3358bc6d8e867947203dfa7dcb0d8a3b432881f02f19f9b21a6b520158622ed0
-
SSDEEP
3072:W57zaulsAswbgQKyJ//xhDcs3SnMd7ehd/X5Ibx1:YavNEtxNOMpez/X5
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a5f859ece359d5fb2b5541b6d27d5b59_JaffaCakes118
Files
-
a5f859ece359d5fb2b5541b6d27d5b59_JaffaCakes118.exe windows:4 windows x86 arch:x86
e7ce753c125031172e118c93e3fe69a1
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
mfc42
ord4129
ord858
ord540
ord1140
ord860
ord941
ord3811
ord3337
ord2820
ord815
ord561
ord800
msvcrt
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
__p___initenv
__p__fmode
_XcptFilter
_exit
_onexit
__dllonexit
__CxxFrameHandler
_mbscmp
__set_app_type
_except_handler3
exit
_controlfp
kernel32
CloseHandle
FreeLibrary
GetSystemDirectoryA
WriteFile
lstrcatA
MoveFileExA
WinExec
Sleep
CreateFileA
SizeofResource
LockResource
GetTempPathA
WritePrivateProfileStringA
GetShortPathNameA
GetEnvironmentVariableA
lstrcpyA
GetCurrentProcess
SetPriorityClass
GetCurrentThread
SetThreadPriority
CreateProcessA
ResumeThread
GetModuleFileNameA
LoadLibraryA
FindResourceA
LoadResource
advapi32
StartServiceA
OpenServiceA
OpenSCManagerA
CloseServiceHandle
msvcp60
??0_Winit@std@@QAE@XZ
??1Init@ios_base@std@@QAE@XZ
??0Init@ios_base@std@@QAE@XZ
??1_Winit@std@@QAE@XZ
Sections
�M��t Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�M��ta Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
�M��a Size: 4KB - Virtual size: 724B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 120KB - Virtual size: 119KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Jw� Size: 432B - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE