Overview

overview

10

Static

static

3

b987ed2106...18.exe

windows7-x64

3

b987ed2106...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b987ed2106872f4561d7d2edb2eb5876_JaffaCakes118

  • Size

    53KB

  • Sample

    240822-3qy8katgka

  • MD5

    b987ed2106872f4561d7d2edb2eb5876

  • SHA1

    9e467466a772ba5c8134210526e0c261e6b0f707

  • SHA256

    81d464cbf3b574bfd33e3dc18644fa2946dc567654a6e83bfe23b78594bf78d7

  • SHA512

    47c233c2733556ac2b3f405d6f70546a5f3ae6d5fa8a193888bfda8b9b384d1f529887a620b8f4467d03c14a4b66069d636eb878730a5110a833dfc8826c0a5f

  • SSDEEP

    1536:obeMDyISB9r77bqTP43fN3JIJkmtuUJ+XGRHpiHg9:obNDsn7ek3fUJkAJ+XmH9

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      b987ed2106872f4561d7d2edb2eb5876_JaffaCakes118

    • Size

      53KB

    • MD5

      b987ed2106872f4561d7d2edb2eb5876

    • SHA1

      9e467466a772ba5c8134210526e0c261e6b0f707

    • SHA256

      81d464cbf3b574bfd33e3dc18644fa2946dc567654a6e83bfe23b78594bf78d7

    • SHA512

      47c233c2733556ac2b3f405d6f70546a5f3ae6d5fa8a193888bfda8b9b384d1f529887a620b8f4467d03c14a4b66069d636eb878730a5110a833dfc8826c0a5f

    • SSDEEP

      1536:obeMDyISB9r77bqTP43fN3JIJkmtuUJ+XGRHpiHg9:obNDsn7ek3fUJkAJ+XmH9

    Score
    10/10
    discoverygh0stratpersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Drops file in Drivers directory

    • Server Software Component: Terminal Services DLL

      persistence

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks