Behavioral task
behavioral1
Sample
fafddf4b1bb35218493a3e3e888d5b96_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
fafddf4b1bb35218493a3e3e888d5b96_JaffaCakes118
-
Size
104KB
-
MD5
fafddf4b1bb35218493a3e3e888d5b96
-
SHA1
1d6cc693bdadc303af3c23e6ed77182bb279187c
-
SHA256
d202c8f69d62b303c791eb38ecbca625c8ee4053a67a7116346e105f8a76924a
-
SHA512
22ed98043895407337e152ddfd1a0006839a066f9c3244b065c49008dc8ce6c86223a1b0422512cd4fa7d4974f7577ef0b4a40b7cecce97ecc5d9b26946fe6d6
-
SSDEEP
3072:70Gjov/qbYp3cFIDwtlcdqDndm/ZfEU8FFrgIPMw:4GjY/q9F1lk0nw/ZsU8DgIPj
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fafddf4b1bb35218493a3e3e888d5b96_JaffaCakes118
Files
-
fafddf4b1bb35218493a3e3e888d5b96_JaffaCakes118.dll windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Sections
.text Size: 68KB - Virtual size: 67KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 7KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.mackt Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE