Overview

overview

10

Static

static

3

fe1894686a...18.exe

windows7-x64

10

fe1894686a...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    fe1894686a0d4941e50d4b897aec57fc_JaffaCakes118

  • Size

    96KB

  • Sample

    240929-jvg1asvgml

  • MD5

    fe1894686a0d4941e50d4b897aec57fc

  • SHA1

    1c89aa39b35721bbee21ff3c968a4bd7c49cbef6

  • SHA256

    04252d1a9775e15271358064348c1ba90ef71605c2315b12ad9a79153fc3b46f

  • SHA512

    f93128ed7d3ee9bf6fd88581975a7b339aa51774b00ca9a8eca4f481a35d88af66854d1bb537062b842eafe9e58f07fb56c78789b918cd8f16031239637d6659

  • SSDEEP

    1536:HkFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prQhf3M/:HWS4jHS8q/3nTzePCwNUh4E9g3M/

Score
10/10
gh0stratbootkitdiscoverypersistencerat

Malware Config

Targets

    • Target

      fe1894686a0d4941e50d4b897aec57fc_JaffaCakes118

    • Size

      96KB

    • MD5

      fe1894686a0d4941e50d4b897aec57fc

    • SHA1

      1c89aa39b35721bbee21ff3c968a4bd7c49cbef6

    • SHA256

      04252d1a9775e15271358064348c1ba90ef71605c2315b12ad9a79153fc3b46f

    • SHA512

      f93128ed7d3ee9bf6fd88581975a7b339aa51774b00ca9a8eca4f481a35d88af66854d1bb537062b842eafe9e58f07fb56c78789b918cd8f16031239637d6659

    • SSDEEP

      1536:HkFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prQhf3M/:HWS4jHS8q/3nTzePCwNUh4E9g3M/

    Score
    10/10
    gh0stratbootkitdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks