ServiceMain
Behavioral task
behavioral1
Sample
da374026d816d45d26703a5fdad1f329_JaffaCakes118.dll
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
da374026d816d45d26703a5fdad1f329_JaffaCakes118.dll
Resource
win10v2004-20240802-en
General
-
Target
da374026d816d45d26703a5fdad1f329_JaffaCakes118
-
Size
58KB
-
MD5
da374026d816d45d26703a5fdad1f329
-
SHA1
c9391e9d6bbf74bf1935e456517753a1eb398b52
-
SHA256
9cc957cc63dec4719b6c9ebbeeb22187e0eb48bb12942d438d7bbdf92728ebf3
-
SHA512
15b73bd853efa78fa05d24180f67d0674d316cccd399f5512337cdcae328fb17e0afb399d9a342f0ebd38c79cc3917142582820a30a535d813315a795df95189
-
SSDEEP
768:rp/aScUhuDVzLSV1XPxzRYGcatVhlHp+liefcMqY4gAy4ub2UsikxPbcdZOB+:rhFFuZ+xrcCHpKfcMqY410MiecKB+
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource da374026d816d45d26703a5fdad1f329_JaffaCakes118
Files
-
da374026d816d45d26703a5fdad1f329_JaffaCakes118.dll windows:4 windows x86 arch:x86
3d26b43d2c31d8a94d2537dd8119eacf
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
CreatePipe
DisconnectNamedPipe
TerminateProcess
LocalAlloc
PeekNamedPipe
WriteFile
WaitForMultipleObjects
GetVersionExA
ReleaseMutex
OpenEventA
GetStartupInfoA
CreateMutexA
SetUnhandledExceptionFilter
Process32Next
Process32First
CreateToolhelp32Snapshot
FreeConsole
lstrcmpiA
GetCurrentThreadId
GetSystemDirectoryA
GetTickCount
MoveFileA
MoveFileExA
TerminateThread
OpenProcess
LoadLibraryA
GetProcAddress
FreeLibrary
lstrcatA
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
GetCurrentProcess
CreateProcessA
LocalFree
SetLastError
GetLastError
GetModuleFileNameA
CreateFileA
InitializeCriticalSection
SetFilePointer
ReadFile
lstrlenA
DeleteFileA
Sleep
lstrcpyA
CancelIo
InterlockedExchange
SetEvent
ResetEvent
WaitForSingleObject
CloseHandle
CreateEventA
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
SetErrorMode
user32
OpenWindowStationA
GetProcessWindowStation
CloseDesktop
SetThreadDesktop
OpenInputDesktop
GetUserObjectInformationA
OpenDesktopA
GetThreadDesktop
wsprintfA
SetProcessWindowStation
advapi32
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenEventLogA
ClearEventLogA
CloseEventLog
RegOpenKeyExA
RegQueryValueA
RegOpenKeyA
RegQueryValueExA
RegCreateKeyA
RegSetValueExA
RegCloseKey
OpenSCManagerA
OpenServiceA
QueryServiceStatus
ControlService
DeleteService
CloseServiceHandle
RegEnumValueA
RegEnumKeyExA
RegisterServiceCtrlHandlerA
SetServiceStatus
shlwapi
SHDeleteKeyA
msvcrt
_adjust_fdiv
_strnicmp
_strcmpi
_initterm
??1type_info@@UAE@XZ
free
calloc
??3@YAXPAX@Z
memmove
ceil
_ftol
strstr
__CxxFrameHandler
??2@YAPAXI@Z
_CxxThrowException
_except_handler3
strncpy
strrchr
malloc
strncat
strchr
realloc
atoi
wcstombs
_beginthreadex
ws2_32
htons
send
recv
getsockname
ntohs
closesocket
gethostbyname
socket
gethostname
connect
setsockopt
WSAStartup
WSACleanup
WSAIoctl
select
wininet
InternetOpenUrlA
InternetOpenA
InternetReadFile
InternetCloseHandle
avicap32
capGetDriverDescriptionA
Exports
Exports
Sections
.text Size: 39KB - Virtual size: 38KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 6KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ