Overview

overview

10

Static

static

7

ee86377548...18.exe

windows7-x64

10

ee86377548...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    ee863775482ade5a25317e22e8e53802_JaffaCakes118

  • Size

    97KB

  • Sample

    240920-14by3s1bnc

  • MD5

    ee863775482ade5a25317e22e8e53802

  • SHA1

    181a71a287a4f44309d78272c9951ad71ce11c5d

  • SHA256

    8bb2f4d99e32692e8b91f2d5b859748b36a4f89e62a32dc90c541ce505abef3f

  • SHA512

    7dba9bab27e5ec4bd35b6a9b49e95c592c9d715ae7bb56abb7a52dc2c276170bcd13dd1f06911111580a4e608c0f166f3c37bed802f26aaf66a57ec30f66c30f

  • SSDEEP

    1536:uV1t4Yv6kRyYctadd6hGE7QaIH/8S1BR7rFfD6j0tTnidKq787P0Irx:uV1tFJnctU6hGkQJkS17FZniUTPtx

Score
10/10
gh0strataspackv2bootkitdiscoverypersistencerat

Malware Config

Targets

    • Target

      ee863775482ade5a25317e22e8e53802_JaffaCakes118

    • Size

      97KB

    • MD5

      ee863775482ade5a25317e22e8e53802

    • SHA1

      181a71a287a4f44309d78272c9951ad71ce11c5d

    • SHA256

      8bb2f4d99e32692e8b91f2d5b859748b36a4f89e62a32dc90c541ce505abef3f

    • SHA512

      7dba9bab27e5ec4bd35b6a9b49e95c592c9d715ae7bb56abb7a52dc2c276170bcd13dd1f06911111580a4e608c0f166f3c37bed802f26aaf66a57ec30f66c30f

    • SSDEEP

      1536:uV1t4Yv6kRyYctadd6hGE7QaIH/8S1BR7rFfD6j0tTnidKq787P0Irx:uV1tFJnctU6hGkQJkS17FZniUTPtx

    Score
    10/10
    gh0stratbootkitdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Server Software Component: Terminal Services DLL

      persistence

    • Sets service image path in registry

      persistence

    • Deletes itself

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks