gh0strat | eeab0d4e43849484549c1c5f758398b4_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

eeab0d4e43849484549c1c5f758398b4_JaffaCakes118
Size

144KB
MD5

eeab0d4e43849484549c1c5f758398b4
SHA1

107d89fa70035a7661d1c6bf59f15662542f9528
SHA256

59f46e3aaab0aec56018ef965463a62b63c76a009347eff9e4ffe2e0636ae13d
SHA512

f32142dee2732a57d954544b849e8f82c79b63fd613ca2dd48eb758bed4a67f515e188b16f84325b9531136328bb9060c77871f70b7fcd77f13bb1956849099d
SSDEEP

3072:+vixrcYyNNBxIf58d6UuSMhXk22T94oz7vEEPzcE6JOag:+GANBxIxh0u4TSg7vEAzcd0F

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
eeab0d4e43849484549c1c5f758398b4_JaffaCakes118

Files

eeab0d4e43849484549c1c5f758398b4_JaffaCakes118
.exe windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 448B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 136KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

NewSec
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data
.rdata
.rsrc/CPP/102
.rsrc/MANIFEST/1
.xml
.rsrc/string.txt
.rsrc/version.txt
.text
NewSec