Overview

overview

10

Static

static

10

cf27d4a556...18.exe

windows7-x64

10

cf27d4a556...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    cf27d4a5567f045e3c31f396cc37a2b7_JaffaCakes118

  • Size

    495KB

  • Sample

    240906-ks4a7axelb

  • MD5

    cf27d4a5567f045e3c31f396cc37a2b7

  • SHA1

    515523a1aa4bfa1d1173ace3f5151fdfbe111d1e

  • SHA256

    a4407d561d5fb34442477190678e9751f5e028a6c1116aca3d6673c6d643f447

  • SHA512

    06d42d705e39501991fcc74834e6d3f7ac50021a6b44b7eb059f8a47bfa0e62750a115d554cc95b78a4740280e1ff237c77fd2a47e34e7c8ff8d54d2229acc34

  • SSDEEP

    6144:y22NXDJlAghv3r+T7wP9xOtWhpjiADPbkRJPMZu527E00w:AXDJlAghv3r+TsP9EtWhpjiAbATMM52h

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      cf27d4a5567f045e3c31f396cc37a2b7_JaffaCakes118

    • Size

      495KB

    • MD5

      cf27d4a5567f045e3c31f396cc37a2b7

    • SHA1

      515523a1aa4bfa1d1173ace3f5151fdfbe111d1e

    • SHA256

      a4407d561d5fb34442477190678e9751f5e028a6c1116aca3d6673c6d643f447

    • SHA512

      06d42d705e39501991fcc74834e6d3f7ac50021a6b44b7eb059f8a47bfa0e62750a115d554cc95b78a4740280e1ff237c77fd2a47e34e7c8ff8d54d2229acc34

    • SSDEEP

      6144:y22NXDJlAghv3r+T7wP9xOtWhpjiADPbkRJPMZu527E00w:AXDJlAghv3r+TsP9EtWhpjiAbATMM52h

    Score
    10/10
    gh0stratdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks