Overview

overview

10

Static

static

3

04de241d24...18.exe

windows7-x64

10

04de241d24...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    04de241d2401096de384b5a9b0f537d4_JaffaCakes118

  • Size

    192KB

  • Sample

    241001-jcvhns1hna

  • MD5

    04de241d2401096de384b5a9b0f537d4

  • SHA1

    fe62f4ed6d3da1ec108c9cddf345b54b6b5a9786

  • SHA256

    a2a74686807129742e697809fed5039dea1c39fbe67937b4dbbc05e7d8689349

  • SHA512

    f7e232a6c0c6c84d85452c80f6770a35b0bb8a579e4c5f8c31a7559b9dcf8443498f4c58884d2f36fd399c8aaa5fdecdbecc86c36bbf611594b5c47be339f058

  • SSDEEP

    3072:oH3ZmFh0Nvq3lbXtsVGja6G+UYy2Fw+hCHSmfcsUXURnpGpMXTee33r31csiH0:oHpmFh0Nvq3lbXtSCGIy26+0wxUREGXi

Score
10/10
gh0stratbootkitdiscoverypersistencerat

Malware Config

Targets

    • Target

      04de241d2401096de384b5a9b0f537d4_JaffaCakes118

    • Size

      192KB

    • MD5

      04de241d2401096de384b5a9b0f537d4

    • SHA1

      fe62f4ed6d3da1ec108c9cddf345b54b6b5a9786

    • SHA256

      a2a74686807129742e697809fed5039dea1c39fbe67937b4dbbc05e7d8689349

    • SHA512

      f7e232a6c0c6c84d85452c80f6770a35b0bb8a579e4c5f8c31a7559b9dcf8443498f4c58884d2f36fd399c8aaa5fdecdbecc86c36bbf611594b5c47be339f058

    • SSDEEP

      3072:oH3ZmFh0Nvq3lbXtsVGja6G+UYy2Fw+hCHSmfcsUXURnpGpMXTee33r31csiH0:oHpmFh0Nvq3lbXtSCGIy26+0wxUREGXi

    Score
    10/10
    gh0stratbootkitdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks