Behavioral task
behavioral1
Sample
bb53fa2abafdf1f4bccb151fc4740120_JaffaCakes118.dll
Resource
win7-20240704-en
General
-
Target
bb53fa2abafdf1f4bccb151fc4740120_JaffaCakes118
-
Size
128KB
-
MD5
bb53fa2abafdf1f4bccb151fc4740120
-
SHA1
0a3b1c714c546ccea8afe9b231136dbb47e8b7ef
-
SHA256
e204ff46c35d1a5568cbf79e5d5e409ae68a7de6118d6caf409b238a5765862d
-
SHA512
4b60a69b90c143bc50c6d2ff50aa1442c55664943dad9b94ce4b4c1c71dc7d4c606ef1ef5d25a330bbb064af932b42f832650983c1b7ec862fabe978ead002f1
-
SSDEEP
768:zasuxPu7AK8DVgdRCgcIKLejme0zzJO5Hm3sBs+ZrCMYokRL0wEZCjpUiTm:Nl7+DuRCgdhjX0/J4HWsv9CMYoNCjh
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource bb53fa2abafdf1f4bccb151fc4740120_JaffaCakes118
Files
-
bb53fa2abafdf1f4bccb151fc4740120_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
.text Size: 119KB - Virtual size: 118KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1024B - Virtual size: 952B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ