gh0strat | f71cb96aa54b46bbd3acf5ad9256bb30_JaffaCakes118 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

f71cb96aa54b46bbd3acf5ad9256bb30_JaffaCakes118
Size

158KB
MD5

f71cb96aa54b46bbd3acf5ad9256bb30
SHA1

ed64a01845d759b919994542a3121b697bc5a0e6
SHA256

c50ca6868c4e2d5615fd3ba9edce242eb970c5bedd41582f3bb7dcbdf9a10b05
SHA512

b26593ec81ce329c4a2641bee6c647939aec272258e3077c7a5a55518287726e68cd9a3980707424e7f9f22b4e7e967b22e3b37cb819e942757a4b8b4bb69ad4
SSDEEP

3072:AJDROeLY8B2FNYnF0sjMXLsm8b3iZnMXuyUZM:AJDgFFN+ulL3AygIM

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f71cb96aa54b46bbd3acf5ad9256bb30_JaffaCakes118

Files

f71cb96aa54b46bbd3acf5ad9256bb30_JaffaCakes118
.exe windows:4 windows x86 arch:x86

a9fe104f08f5d4e709a76c93b4ba42ba

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

lstrlenA
lstrcpyA
GetProcAddress
LoadLibraryW
GlobalMemoryStatus
GetModuleHandleA
GetStartupInfoA

shell32

ShellExecuteA
SHCreateDirectoryExA

msvcrt

__p__commode
strstr
_exit
_XcptFilter
exit
_acmdln
_initterm
__setusermatherr
_adjust_fdiv
__getmainargs
__p__fmode
__set_app_type
_except_handler3
_controlfp

Sections

.text
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 153KB - Virtual size: 156KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ