Behavioral task
behavioral1
Sample
f565cbdbc9985c683a05749e80b60ea7_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
f565cbdbc9985c683a05749e80b60ea7_JaffaCakes118
-
Size
163KB
-
MD5
f565cbdbc9985c683a05749e80b60ea7
-
SHA1
abb79cfed723f3c5db1c3f6a2085413e4da2b36a
-
SHA256
4b476522e13bc2e9bad3c09ac127091ae3bab31f4f5a9e88ef213e4704fa511d
-
SHA512
614abccba8914e87468b0ba904bc5202912cb5501feb475ba2643f788b08be81326c81a37829a1a270ce9eb16ec1c94aa3a7ac919c216abaafa5835868bb0b57
-
SSDEEP
3072:8iufchoWpWXvICjTKsmW4eb+4BreLMnWD5AF7:8ahfpW/I5N541P25A
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource f565cbdbc9985c683a05749e80b60ea7_JaffaCakes118
Files
-
f565cbdbc9985c683a05749e80b60ea7_JaffaCakes118.exe windows:4 windows x86 arch:x86
fb84f72b13c01f3fa728835836df8ff9
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
lstrcpyA
GetEnvironmentVariableA
GetShortPathNameA
GetModuleFileNameA
lstrcmpiA
CreateToolhelp32Snapshot
GetTempPathA
ReleaseMutex
CreateMutexA
GetCommandLineA
WinExec
CreateThread
LoadLibraryA
GetStartupInfoA
SetPriorityClass
GetCurrentThread
SetThreadPriority
CreateProcessA
ResumeThread
SetFilePointer
ReadFile
GetTickCount
FindFirstFileA
LocalFileTimeToFileTime
SetFileTime
lstrlenA
MoveFileA
GetVersion
lstrcatA
GetModuleHandleA
GetLastError
CloseHandle
WriteFile
CreateFileA
GetCurrentProcess
GetProcAddress
DeleteFileA
CopyFileA
MoveFileExA
GetWindowsDirectoryA
ExitProcess
Sleep
Process32Next
Process32First
OpenProcess
WaitForSingleObject
CreateRemoteThread
FreeLibrary
user32
LoadIconA
LoadCursorA
RegisterClassExA
CreateWindowExA
BlockInput
UpdateWindow
GetMessageA
TranslateMessage
DispatchMessageA
DefWindowProcA
PostThreadMessageA
GetInputState
ShowWindow
FindWindowA
PostMessageA
wsprintfA
msvcrt
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
??2@YAPAXI@Z
isdigit
strtoul
strncmp
malloc
??3@YAXPAX@Z
strchr
_except_handler3
_strlwr
strstr
_strrev
advapi32
ControlService
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegOpenKeyExA
RegCloseKey
OpenServiceA
OpenSCManagerA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
CloseServiceHandle
StartServiceA
UnlockServiceDatabase
ChangeServiceConfigA
LockServiceDatabase
shell32
ShellExecuteA
SHGetSpecialFolderPathA
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 142KB - Virtual size: 141KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ