gh0strat | b06b90167d120c7727035ec1add20ffd_JaffaCakes118 | Triage

Sharing

General

Target

b06b90167d120c7727035ec1add20ffd_JaffaCakes118
Size

232KB
MD5

b06b90167d120c7727035ec1add20ffd
SHA1

8e258a74441d6da7c35357dcb1a6c5731b7d222c
SHA256

3ab37222c0a5b77920c7f043a06543e7780ef2c05ed46aa5298e8112bf1f746e
SHA512

0f179371e80583a7291b10204941a2eb9410093004a609bf51fb4f1165caacc52bfb3e016ba9b24210be86594a6f176cdebbf04c164db0a1807b2af874964c25
SSDEEP

3072:sYaJKyTeTY1km5WBqwP3fspQ/Xz7iasXbyC/hX6xxv34Ut7LEwn:stJ3iTtiWB0mL7tyJ5Mp34O5n

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b06b90167d120c7727035ec1add20ffd_JaffaCakes118

Files

b06b90167d120c7727035ec1add20ffd_JaffaCakes118
.exe windows:4 windows x86 arch:x86

c4a2407f5c26628324f031bb68c39a54

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

FreeLibrary
GetProcAddress
LoadLibraryA
CloseHandle
WriteFile
CreateFileA
ReadFile
SetFilePointer
CreateDirectoryA
WinExec
WideCharToMultiByte
SetFileAttributesW
CreateFileW
GetModuleFileNameW
ExpandEnvironmentStringsA
GetTickCount
GetModuleHandleA
GetStartupInfoA

msvcrt

sprintf
rand
??2@YAPAXI@Z
wcslen
srand
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
??3@YAXPAX@Z
strncpy

Sections

.text
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 992B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 592B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ