Overview

overview

10

Static

static

3

e1354b3909...18.exe

windows7-x64

10

e1354b3909...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e1354b3909b18a857849c11ad834dc7b_JaffaCakes118

  • Size

    662KB

  • Sample

    240914-2yxt2asajc

  • MD5

    e1354b3909b18a857849c11ad834dc7b

  • SHA1

    dd2cc704b92fab97172406a241b71c17b25ec2cf

  • SHA256

    ebadd716d888c2e0e52c5d901e5cebd9ca91653a8b7d553a90917536529b11d8

  • SHA512

    2a3fdb58eac3ce10dd9d8b0087189a01552c4ef34ff08a4e27e3df24d76337a3d0f593c0d2f4237a03f8abd2fd02254e21a508dee537ce2f9ede5b5548029c86

  • SSDEEP

    6144:QtP96wgvRHCzOYtqlGyzcsX3KA0LQIQRsUhNwLQSrFr9DTRKv:Qz3gNCpOdn/upU/m5rfKv

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      e1354b3909b18a857849c11ad834dc7b_JaffaCakes118

    • Size

      662KB

    • MD5

      e1354b3909b18a857849c11ad834dc7b

    • SHA1

      dd2cc704b92fab97172406a241b71c17b25ec2cf

    • SHA256

      ebadd716d888c2e0e52c5d901e5cebd9ca91653a8b7d553a90917536529b11d8

    • SHA512

      2a3fdb58eac3ce10dd9d8b0087189a01552c4ef34ff08a4e27e3df24d76337a3d0f593c0d2f4237a03f8abd2fd02254e21a508dee537ce2f9ede5b5548029c86

    • SSDEEP

      6144:QtP96wgvRHCzOYtqlGyzcsX3KA0LQIQRsUhNwLQSrFr9DTRKv:Qz3gNCpOdn/upU/m5rfKv

    Score
    10/10
    gh0stratdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks