Overview

overview

10

Static

static

3

c980a5632f...18.exe

windows7-x64

10

c980a5632f...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c980a5632fdf0ce9dacd2285c1f73fef_JaffaCakes118

  • Size

    130KB

  • Sample

    240829-yd923szcmq

  • MD5

    c980a5632fdf0ce9dacd2285c1f73fef

  • SHA1

    b6a76d0246bc2217a9f35bbe8f147d99c54fbecf

  • SHA256

    0958311cdbc72029fff008692d4d344bcbfa6df469f3181309b93cd1429ce8d6

  • SHA512

    8ccf64420f6f63528caef9a5554b20aa6c15cda7e5f18eea9814c0b8966af504f6d272f0d44c5416f718013e3953e1b417a90447ac7bd58de6e7e94f5a1e3e13

  • SSDEEP

    3072:IsY8JPMTtmi0vZemB0taM5Gmjck0huCP3F:PGc9smesY4kjC/F

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      c980a5632fdf0ce9dacd2285c1f73fef_JaffaCakes118

    • Size

      130KB

    • MD5

      c980a5632fdf0ce9dacd2285c1f73fef

    • SHA1

      b6a76d0246bc2217a9f35bbe8f147d99c54fbecf

    • SHA256

      0958311cdbc72029fff008692d4d344bcbfa6df469f3181309b93cd1429ce8d6

    • SHA512

      8ccf64420f6f63528caef9a5554b20aa6c15cda7e5f18eea9814c0b8966af504f6d272f0d44c5416f718013e3953e1b417a90447ac7bd58de6e7e94f5a1e3e13

    • SSDEEP

      3072:IsY8JPMTtmi0vZemB0taM5Gmjck0huCP3F:PGc9smesY4kjC/F

    Score
    10/10
    gh0stratdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks