gh0strat | d110870be5ebf2fe4fce46f7789d70c7_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

d110870be5ebf2fe4fce46f7789d70c7_JaffaCakes118
Size

152KB
MD5

d110870be5ebf2fe4fce46f7789d70c7
SHA1

0cc74c292eb0f3dc743ce458a92240d51a34675e
SHA256

ce87e04fd6647306d23afb7ceb191d06174961cf4247ec132dc1a853d5267c2a
SHA512

5eeb7e35d5964d42d32729a17351d8c26e3344fc2616bc375092084d3d74ffd56bbaecb9f56f637a4bf494ba88ea99c293a16feea6a79585ade6c6b4751d4ee2
SSDEEP

3072:iBqI3qf6NooVKlIxJk7Lsp5nBFPCdTBftgutxPKKoYHL:K3xKexJk7qnBFqdTBlguPS0r

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d110870be5ebf2fe4fce46f7789d70c7_JaffaCakes118

Files

d110870be5ebf2fe4fce46f7789d70c7_JaffaCakes118
.dll windows:4 windows x86 arch:x86

2879d7a09538823c212672a61e67557b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

oleaut32

SysFreeString

kernel32

GetSystemInfo
GetVersionExA
GetProcessTimes
GetCurrentProcess
GlobalMemoryStatusEx
lstrcatA
lstrcpyA
GetSystemDirectoryA
HeapFree
GetProcessHeap
VirtualFree
GetTickCount
HeapAlloc
DeleteFileA
RemoveDirectoryA
ExitThread
GetShortPathNameA
GetModuleFileNameA
IsBadReadPtr
IsBadStringPtrW
InitializeCriticalSection
LeaveCriticalSection
VirtualAlloc
VirtualQuery
GetLocalTime
GlobalUnlock
GlobalLock
GlobalSize
MapViewOfFile
lstrlenA
CreateFileMappingA
LocalFree
LocalAlloc
lstrcmpiA
GetCurrentThreadId
MultiByteToWideChar
FreeLibrary
GetProcAddress
lstrcmpA
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
SetUnhandledExceptionFilter
FormatMessageA
GetModuleHandleA
IsBadWritePtr
InterlockedExchange
GlobalFree
GlobalAlloc
CloseHandle
ExitProcess
LocalSize
GetTempFileNameA
GetCommandLineA
WinExec
GetCurrentProcessId
GetFileAttributesExA
SetEnvironmentVariableA
GetTempPathA
GetLongPathNameA
GetLastError
LocalReAlloc

user32

DestroyWindow
wvsprintfA
CopyRect
LoadCursorA
DestroyCursor
PtInRect
CreateWindowExA
GetClassNameA
GetWindow
ShowWindow
EnableWindow
GetWindowRect
MessageBoxA
CloseWindowStation
wsprintfA
GetCursorInfo

advapi32

QueryServiceStatusEx
RegOpenKeyExW
RegisterServiceCtrlHandlerExA

ole32

CoTaskMemFree
CoUninitialize
CoCreateInstance
CoInitialize

shlwapi

SHDeleteKeyA

shell32

SHFileOperationA

userenv

GetProfilesDirectoryA
GetUserProfileDirectoryA

ws2_32

select
connect
socket
WSAStartup
WSACleanup
gethostname
getsockname
gethostbyname
closesocket
shutdown
send
WSAIoctl
setsockopt
recv

iphlpapi

GetAdaptersInfo

msvcrt

_adjust_fdiv
_initterm
_stricmp
_memicmp
_strupr
_wcsicmp
_strlwr
??2@YAPAXI@Z
realloc
wcsrchr
atol
strncat
strrchr
malloc
_onexit
strstr
__dllonexit
_beginthreadex
wcslen
ceil
wcstombs
_except_handler3
__CxxFrameHandler
free
memmove
_ftol
time
srand
rand
strchr
atoi
strncpy
??3@YAXPAX@Z

Exports

Exports

DhcpAcquireParameters
DhcpAcquireParametersByBroadcast
DhcpCApiCleanup
DhcpCApiInitialize
DhcpDeRegisterOptions
DhcpDeRegisterParamChange
DhcpDelPersistentRequestParams
DhcpEnumClasses
DhcpFallbackRefreshParams
DhcpHandlePnPEvent
DhcpLeaseIpAddress
DhcpLeaseIpAddressEx
DhcpNotifyConfigChange
DhcpNotifyConfigChangeEx
DhcpNotifyMediaReconnected
DhcpOpenGlobalEvent
DhcpPersistentRequestParams
DhcpRegisterOptions
DhcpRegisterParamChange
DhcpReleaseIpAddressLease
DhcpReleaseIpAddressLeaseEx
DhcpReleaseParameters
DhcpRemoveDNSRegistrations
DhcpRenewIpAddressLease
DhcpRenewIpAddressLeaseEx
DhcpRequestOptions
DhcpRequestParams
DhcpStaticRefreshParams
DhcpUndoRequestParams
McastApiCleanup
McastApiStartup
McastEnumerateScopes
McastGenUID
McastReleaseAddress
McastRenewAddress

Sections

.text
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2879d7a09538823c212672a61e67557b

Headers

File Characteristics

Imports

oleaut32

kernel32

user32

advapi32

ole32

shlwapi

shell32

userenv

ws2_32

iphlpapi

msvcrt

Exports

Exports

Sections

.text Size: 100KB - Virtual size: 99KB

.rdata Size: 24KB - Virtual size: 20KB

.data Size: 12KB - Virtual size: 17KB

.rsrc Size: 4KB - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 100KB - Virtual size: 99KB

.rdata
Size: 24KB - Virtual size: 20KB

.data
Size: 12KB - Virtual size: 17KB

.rsrc
Size: 4KB - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 7KB