Overview

overview

10

Static

static

10

d09e27ec00...18.exe

windows7-x64

10

d09e27ec00...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d09e27ec00a9ba98b61a8e8dbbc6caa8_JaffaCakes118

  • Size

    109KB

  • Sample

    240906-24mk9asdnp

  • MD5

    d09e27ec00a9ba98b61a8e8dbbc6caa8

  • SHA1

    a4c1ac76b9a9ecfb7ccdcdda35e721215c8ae3f7

  • SHA256

    5c3b3384a2038e76be9d77135bf5201c1e7d36d7cb03fc2f67e5d209a1dd5252

  • SHA512

    f1cb5de124b8e622ebf77d12196e190770ebca10b0bebbb402237c8217f47663d50a51e91b41604e1ecfb99aadfce09ce45a3849853ef3e01e58d55bf4a4f844

  • SSDEEP

    3072:/bht0aSxmZotRML3FeJjKqMj2Thci7IE2UJn6:/70aImZoLML3AJl1ei8iJn6

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      d09e27ec00a9ba98b61a8e8dbbc6caa8_JaffaCakes118

    • Size

      109KB

    • MD5

      d09e27ec00a9ba98b61a8e8dbbc6caa8

    • SHA1

      a4c1ac76b9a9ecfb7ccdcdda35e721215c8ae3f7

    • SHA256

      5c3b3384a2038e76be9d77135bf5201c1e7d36d7cb03fc2f67e5d209a1dd5252

    • SHA512

      f1cb5de124b8e622ebf77d12196e190770ebca10b0bebbb402237c8217f47663d50a51e91b41604e1ecfb99aadfce09ce45a3849853ef3e01e58d55bf4a4f844

    • SSDEEP

      3072:/bht0aSxmZotRML3FeJjKqMj2Thci7IE2UJn6:/70aImZoLML3AJl1ei8iJn6

    Score
    10/10
    gh0stratdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Server Software Component: Terminal Services DLL

      persistence

    • Deletes itself

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks