Behavioral task
behavioral1
Sample
c95e1a66d00882898dc8b495c082e732_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
c95e1a66d00882898dc8b495c082e732_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
c95e1a66d00882898dc8b495c082e732_JaffaCakes118
-
Size
92KB
-
MD5
c95e1a66d00882898dc8b495c082e732
-
SHA1
1db625bb22648292052c6c111ea6c1f5a8c9f04c
-
SHA256
0a2546d30fbc3123c5ed4c70f0508ee167b8eccffd77200e6f9cf8250bd71e6a
-
SHA512
fd40dd62921f60dcde0af43d3b76bd79db6acd3f99c0c2c3cafdd4aa2d33fff794059c527c23376ecabddaef2f4c6d7471212eaf0a1d9b7d4df6412783d74ea4
-
SSDEEP
1536:cXKUasc2h8qOdYqLDfhjw1qcpuufa3sDeOgbxewmw5Q2:9UascBYkDfNw1q2uoa3sKOYewmw5Q2
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource c95e1a66d00882898dc8b495c082e732_JaffaCakes118
Files
-
c95e1a66d00882898dc8b495c082e732_JaffaCakes118.exe windows:4 windows x86 arch:x86
329471665f5c4c5f677765b61d503254
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetModuleFileNameA
lstrlenA
LoadLibraryA
MoveFileExA
DeleteFileA
FreeResource
GetSystemDirectoryA
CreateFileA
GlobalAlloc
lstrcpyA
lstrcmpiA
SetLastError
LoadResource
FindResourceA
SizeofResource
Sleep
ExitProcess
CreateThread
VirtualAlloc
CloseHandle
VirtualAllocEx
VirtualProtectEx
GetModuleHandleA
GetProcAddress
WriteProcessMemory
SetThreadContext
ResumeThread
TerminateProcess
CreateProcessW
GetThreadContext
ReadProcessMemory
VirtualQueryEx
GetTickCount
lstrcatA
WriteFile
GetLastError
RaiseException
InterlockedExchange
LocalAlloc
FreeLibrary
gdi32
GetStockObject
advapi32
OpenSCManagerA
CreateServiceA
CloseServiceHandle
OpenServiceA
ChangeServiceConfigA
StartServiceA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
msvcrt
strlen
??2@YAPAXI@Z
fread
ftell
fseek
fclose
fopen
memcpy
strstr
realloc
malloc
__CxxFrameHandler
_CxxThrowException
??3@YAXPAX@Z
??1type_info@@UAE@XZ
strcat
strchr
_except_handler3
_strrev
Sections
.text Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.MUTI Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 81KB - Virtual size: 80KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ