Behavioral task
behavioral1
Sample
b6e037dc0770ff8bd34b1eb512f39022_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
b6e037dc0770ff8bd34b1eb512f39022_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b6e037dc0770ff8bd34b1eb512f39022_JaffaCakes118
-
Size
92KB
-
MD5
b6e037dc0770ff8bd34b1eb512f39022
-
SHA1
b40382f5e1a89041b006c8f15dab642464267edd
-
SHA256
2600e0cb00e1386d3ac4886d78b7785e396a01b44aa7d6e90b77bde4112aac0d
-
SHA512
01ac6e1092dcd596659a355a5bb7877bb32fa8cf5236ff5da012dc808af86edb686aae8e4b6a8b54c3b874bfe20f2d22918ae6aea49c19278f0164e724d1dcf8
-
SSDEEP
1536:cXKUast2h8qOdYqLDfhjw1qcpuufa3sDeOgbxewmw5QIl:9UastBYkDfNw1q2uoa3sKOYewmw5QIl
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b6e037dc0770ff8bd34b1eb512f39022_JaffaCakes118
Files
-
b6e037dc0770ff8bd34b1eb512f39022_JaffaCakes118.exe windows:4 windows x86 arch:x86
329471665f5c4c5f677765b61d503254
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameA
lstrlenA
LoadLibraryA
MoveFileExA
DeleteFileA
FreeResource
GetSystemDirectoryA
CreateFileA
GlobalAlloc
lstrcpyA
lstrcmpiA
SetLastError
LoadResource
FindResourceA
SizeofResource
Sleep
ExitProcess
CreateThread
VirtualAlloc
CloseHandle
VirtualAllocEx
VirtualProtectEx
GetModuleHandleA
GetProcAddress
WriteProcessMemory
SetThreadContext
ResumeThread
TerminateProcess
CreateProcessW
GetThreadContext
ReadProcessMemory
VirtualQueryEx
GetTickCount
lstrcatA
WriteFile
GetLastError
RaiseException
InterlockedExchange
LocalAlloc
FreeLibrary
gdi32
GetStockObject
advapi32
OpenSCManagerA
CreateServiceA
CloseServiceHandle
OpenServiceA
ChangeServiceConfigA
StartServiceA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
msvcrt
strlen
??2@YAPAXI@Z
fread
ftell
fseek
fclose
fopen
memcpy
strstr
realloc
malloc
__CxxFrameHandler
_CxxThrowException
??3@YAXPAX@Z
??1type_info@@UAE@XZ
strcat
strchr
_except_handler3
_strrev
Sections
.text Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.MUTI Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 81KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ