Behavioral task
behavioral1
Sample
fc8b24a4759a769ac7b10ae6956c9e8e_JaffaCakes118.exe
Resource
win7-20240903-en
General
-
Target
fc8b24a4759a769ac7b10ae6956c9e8e_JaffaCakes118
-
Size
816KB
-
MD5
fc8b24a4759a769ac7b10ae6956c9e8e
-
SHA1
651b2f7fc1893b7acb11c0e95d31c9fd7b750285
-
SHA256
553e288483362867043455211935189c4ed7a2918850abb9f7b07ca0bd4a485b
-
SHA512
c67031b4b6f5d7ccd17f485206ede4eba64ab53c6021fea58a92af5181a59af6335af86ab7e6047b337961e833fb45ef00afd21c9980a1fb60c9462aebfe9144
-
SSDEEP
6144:MX3hWHA9DNYtEHhvF3TBljnob0aa921blYWRnbX3BvE0xbZg+:MX3h6AQqHtF3T36rfYENEabZj
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource fc8b24a4759a769ac7b10ae6956c9e8e_JaffaCakes118
Files
-
fc8b24a4759a769ac7b10ae6956c9e8e_JaffaCakes118.exe windows:4 windows x86 arch:x86
edada803b25662af6e5310b95af49338
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
ExitProcess
lstrcatA
lstrcpyA
GetModuleFileNameA
DeleteFileA
EndUpdateResourceA
UpdateResourceA
BeginUpdateResourceA
ReadFile
GetFileSize
MoveFileA
WritePrivateProfileStringA
lstrlenA
SetFilePointer
Sleep
CloseHandle
WriteFile
CreateFileA
LoadResource
SizeofResource
FindResourceA
GetLocalTime
WinExec
GetCurrentThreadId
GetStringTypeW
GetStringTypeA
LCMapStringW
LCMapStringA
MultiByteToWideChar
SetStdHandle
LoadLibraryA
GetProcAddress
GetOEMCP
GetModuleHandleA
GetStartupInfoA
GetCommandLineA
GetVersion
HeapFree
HeapAlloc
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
RtlUnwind
GetLastError
VirtualAlloc
HeapReAlloc
GetCPInfo
GetACP
FlushFileBuffers
user32
wsprintfA
GetMessageA
PostThreadMessageA
GetInputState
ole32
CoCreateGuid
CoInitialize
CoUninitialize
Sections
.text Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 776KB - Virtual size: 776KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ