Overview

overview

10

Static

static

3

dedbca4f0b...18.exe

windows7-x64

10

dedbca4f0b...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    dedbca4f0b8e5a2513ad35d81d5c530f_JaffaCakes118

  • Size

    552KB

  • Sample

    240913-zetxxsyarg

  • MD5

    dedbca4f0b8e5a2513ad35d81d5c530f

  • SHA1

    ab04930ca35c00ac89e5be5a578589668b21a6cc

  • SHA256

    673c737ca462deaf72f25be84d29582d1dbfaab68b9ddb8528de519ea9a51d5c

  • SHA512

    2c361808ddffc3e0612a605e2dcabbd5b244bbb13a6a1ad2bd1589a75d917eb7c276ea1fd8d8a266efc01ceb6f0116d3cdb25fa46e520f71a9fe0005f46d3085

  • SSDEEP

    12288:Q9XMzS3DyFImmr8wYbF0wp3kskcRAdAVx64eI7oFcnzd8PHo:Q9XWHr

Score
10/10
gh0stratbootkitdiscoverypersistencerat

Malware Config

Targets

    • Target

      dedbca4f0b8e5a2513ad35d81d5c530f_JaffaCakes118

    • Size

      552KB

    • MD5

      dedbca4f0b8e5a2513ad35d81d5c530f

    • SHA1

      ab04930ca35c00ac89e5be5a578589668b21a6cc

    • SHA256

      673c737ca462deaf72f25be84d29582d1dbfaab68b9ddb8528de519ea9a51d5c

    • SHA512

      2c361808ddffc3e0612a605e2dcabbd5b244bbb13a6a1ad2bd1589a75d917eb7c276ea1fd8d8a266efc01ceb6f0116d3cdb25fa46e520f71a9fe0005f46d3085

    • SSDEEP

      12288:Q9XMzS3DyFImmr8wYbF0wp3kskcRAdAVx64eI7oFcnzd8PHo:Q9XWHr

    Score
    10/10
    gh0stratbootkitdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Server Software Component: Terminal Services DLL

      persistence

    • Sets service image path in registry

      persistence

    • Deletes itself

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks