Extracted

• • Target

    fc9b0b8b711e44ce0d4f91b0cedb1c76_JaffaCakes118

  • Size

    68KB

  • MD5

    fc9b0b8b711e44ce0d4f91b0cedb1c76

  • SHA1

    7efc7fec7c6f04dd6cf00344f7d0781aa6858536

  • SHA256

    b1912fe759ce5a90de1e18e62b39e416ed4fde549ae0b10bee4173f4bbb09c36

  • SHA512

    1e0c4dc4cc865eccb20d1a92922fed7f923fe6225a21553f5a25f7a836db755b48285baad0d4da17a7a689790930ead38a491871c55fa21c6e4e497ea875c774

  • SSDEEP

    1536:Jn/hoh1mHzLJksPEOajozLElnqiO2d7/Zu:Jn/swTLJkQ7zAV3d7/k

  Score

  10^/10

  gh0stratdiscoverypersistencerat

  • Gh0st RAT payload

  • Gh0strat

    Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    ratgh0strat

  • Server Software Component: Terminal Services DLL

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Creates a Windows Service

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2