Behavioral task
behavioral1
Sample
046ad10b25dfdd12c721aa0b8719ed18_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
046ad10b25dfdd12c721aa0b8719ed18_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
046ad10b25dfdd12c721aa0b8719ed18_JaffaCakes118
-
Size
124KB
-
MD5
046ad10b25dfdd12c721aa0b8719ed18
-
SHA1
bb1da5fe0aa30655a550f3aea1dd9b9502903eaf
-
SHA256
db1dbb7d716771515a281f919cc2e16f9f35d033b3cae3bcfe276d6941339378
-
SHA512
0ab8060a72873097fb256c7855b02279e53e7afa9c6c196e9dfb94ff311fb99599c34c21ccee72d2f3f2c7e43f7a29915bfcab571b6713fd36c4a571631a2a86
-
SSDEEP
3072:T9+HqltB5TI8J7ZVuRh/DBiE/IqKlDcDs:TM65TIkZQLDwLqcDcQ
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 046ad10b25dfdd12c721aa0b8719ed18_JaffaCakes118
Files
-
046ad10b25dfdd12c721aa0b8719ed18_JaffaCakes118.exe windows:4 windows x86 arch:x86
5aedf8e10c7bfeb751244119ae03da9d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateFileA
LoadResource
FindResourceA
lstrcatA
GetTempPathA
GetFileAttributesA
GetSystemDirectoryA
Sleep
lstrlenA
GetModuleFileNameA
SetUnhandledExceptionFilter
SystemTimeToFileTime
GetLastError
CreateMutexA
GetCommandLineA
GetCurrentThreadId
GetProcAddress
HeapReAlloc
VirtualAlloc
HeapAlloc
LocalFileTimeToFileTime
SetFileTime
SizeofResource
WriteFile
CloseHandle
MoveFileA
SetFileAttributesA
ExitProcess
DeleteFileA
ReleaseMutex
GetModuleHandleA
GetStartupInfoW
GetVersion
GetCPInfo
GetACP
GetOEMCP
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetModuleFileNameW
FreeEnvironmentStringsA
MultiByteToWideChar
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetEnvironmentStrings
GetCommandLineW
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
HeapDestroy
HeapCreate
VirtualFree
HeapFree
RtlUnwind
WideCharToMultiByte
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
LoadLibraryA
user32
GetInputState
PostThreadMessageA
GetMessageA
LoadIconA
advapi32
OpenServiceA
OpenSCManagerA
CloseServiceHandle
ChangeServiceConfigA
ControlService
StartServiceA
RegCreateKeyExA
RegSetValueExA
RegCloseKey
Sections
.text Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 105KB - Virtual size: 105KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ