Overview

overview

10

Static

static

3

fa2ff70181...18.exe

windows7-x64

10

fa2ff70181...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fa2ff70181db2c32d0f2f5efc27fd0f2_JaffaCakes118

  • Size

    237KB

  • Sample

    240927-lwf6hazara

  • MD5

    fa2ff70181db2c32d0f2f5efc27fd0f2

  • SHA1

    ba66ec6a63f435ce5fa332459fda516bed08e15d

  • SHA256

    dd32dfc713608587bcef5c0b137a687e3fdd3ab31f11e68b04257117627f8167

  • SHA512

    4c6e2c67967617994480fee69fd729413e7ef6930665707228f36fba4a167a09f4329ddc9cc0726fecf775242b93cfb6fac6dd879a2e67291582f8c9a127e8ad

  • SSDEEP

    6144:q3ouBn5oP8qxFrthTZW2665Qu46uYZ4gK4Z8:aBn5oP8qxFrXv665Qu46uY6/

Score
10/10
gh0stratbootkitdiscoverypersistencerat

Malware Config

Targets

    • Target

      fa2ff70181db2c32d0f2f5efc27fd0f2_JaffaCakes118

    • Size

      237KB

    • MD5

      fa2ff70181db2c32d0f2f5efc27fd0f2

    • SHA1

      ba66ec6a63f435ce5fa332459fda516bed08e15d

    • SHA256

      dd32dfc713608587bcef5c0b137a687e3fdd3ab31f11e68b04257117627f8167

    • SHA512

      4c6e2c67967617994480fee69fd729413e7ef6930665707228f36fba4a167a09f4329ddc9cc0726fecf775242b93cfb6fac6dd879a2e67291582f8c9a127e8ad

    • SSDEEP

      6144:q3ouBn5oP8qxFrthTZW2665Qu46uYZ4gK4Z8:aBn5oP8qxFrXv665Qu46uY6/

    Score
    10/10
    gh0stratbootkitdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks