Overview

overview

10

Static

static

10

ce1e88028b...18.exe

windows7-x64

10

ce1e88028b...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ce1e88028b9e5b755bfb9676509e7b0b_JaffaCakes118

  • Size

    140KB

  • Sample

    240905-23kp9stbpn

  • MD5

    ce1e88028b9e5b755bfb9676509e7b0b

  • SHA1

    9ac062a0b40bca6adc1b589ec2088c69346b49e1

  • SHA256

    b77fe4ddb83584d02b3e469c25f8153ce8f61b3bade442de6ba7dcd8515387b7

  • SHA512

    f14af6523c97c54ae74d7a7d39a9f40ca094b21c58cea761dc27e9a988994e41ed6dcfd31c749d411f2c4b7f42451954208a75d8c8974d73040ad58243452bd6

  • SSDEEP

    3072:O0UfAwJADLBXO+7D3MRUieeKf5++Jahjv:O0UbIlEUZrf5++Ja

Score
10/10
gh0stratdiscoverypersistenceprivilege_escalationrat

Malware Config

Targets

    • Target

      ce1e88028b9e5b755bfb9676509e7b0b_JaffaCakes118

    • Size

      140KB

    • MD5

      ce1e88028b9e5b755bfb9676509e7b0b

    • SHA1

      9ac062a0b40bca6adc1b589ec2088c69346b49e1

    • SHA256

      b77fe4ddb83584d02b3e469c25f8153ce8f61b3bade442de6ba7dcd8515387b7

    • SHA512

      f14af6523c97c54ae74d7a7d39a9f40ca094b21c58cea761dc27e9a988994e41ed6dcfd31c749d411f2c4b7f42451954208a75d8c8974d73040ad58243452bd6

    • SSDEEP

      3072:O0UfAwJADLBXO+7D3MRUieeKf5++Jahjv:O0UbIlEUZrf5++Ja

    Score
    10/10
    gh0stratdiscoverypersistenceprivilege_escalationrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Event Triggered Execution: AppCert DLLs

      Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppCert DLLs loaded into processes.

      persistenceprivilege_escalation
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks