Behavioral task
behavioral1
Sample
a8c8f73901206a771d2c18952cae3fdf_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
a8c8f73901206a771d2c18952cae3fdf_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
a8c8f73901206a771d2c18952cae3fdf_JaffaCakes118
-
Size
811KB
-
MD5
a8c8f73901206a771d2c18952cae3fdf
-
SHA1
d1e119267b626cd93408458de52bb0717fa1bb98
-
SHA256
a63429df644109e4c7141b28d65ecd7957910e23f7897fbd8ae63cbc24f12a9b
-
SHA512
f5b12be96a8fd623d85b007673ed15b856415a926b8ab51e7b176a40fe11399946a0df2d9fc711405a581c6924686ee6cc75854effa5361698daf3fb0258277b
-
SSDEEP
12288:HOBJeDyGLJIDgqBr0nVhlMDxvtTJuw+7R4WwRa+xb4Jotq+bJtAq0oZQAKHr9eP:HIvwnVhlMDxlThoCWh+eJotdR0ovmr9s
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource a8c8f73901206a771d2c18952cae3fdf_JaffaCakes118
Files
-
a8c8f73901206a771d2c18952cae3fdf_JaffaCakes118.exe windows:4 windows x86 arch:x86
baa93d47220682c04d92f7797d9224ce
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcpy
comctl32
InitCommonControls
Sections
Size: 9KB - Virtual size: 28KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 14KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Size: 512B - Virtual size: 812KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
yjqujqjh Size: 667KB - Virtual size: 668KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
lsxedfnt Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE