gh0strat | 0b18f45359853e4da8aca4d72a6c79e0_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
0b18f45359853e4da8aca4d72a6c79e0_JaffaCakes118
Size 880KB
Sample241002-rpdppa1bjn
SHA256 262c0b4439f9ac89a6428e113c24827d2b27e06420a473ca9402898f0c207c28
MD5 0b18f45359853e4da8aca4d72a6c79e0
SHA1 8aa63f8c0520d2f316e063a93ce83913fa65d28a
SHA512 b1a7574fea530085013d3b756cba3409adc8dcd43aec7d2ba2a1e95ecefd8be95e570e8f0a6dfe0d5041211838b3cb838d7a1a69db3c2c644de480d93df5b23f
SSDEEP 12288:/M5REAfL3aKHx5r+TuxXzNWJBhiFHzsVK2okHANUTNCte:/M5RE23aKHx5r+TuxXzcBsFHUoFte
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0b18f45359853e4da8aca4d72a6c79e0_JaffaCakes118

File Explorer

0b18f45359853e4da8aca4d72a6c79e0_JaffaCakes118

.exe 880KB

0b18f45359853e4da8aca4d72a6c79e0_JaffaCakes118

IMPHASH 6e823d9b1eea64189ab47ad8b130d058
SHA256 262c0b4439f9ac89a6428e113c24827d2b27e06420a473ca9402898f0c207c28
MD5 0b18f45359853e4da8aca4d72a6c79e0
SHA1 8aa63f8c0520d2f316e063a93ce83913fa65d28a
SHA512 b1a7574fea530085013d3b756cba3409adc8dcd43aec7d2ba2a1e95ecefd8be95e570e8f0a6dfe0d5041211838b3cb838d7a1a69db3c2c644de480d93df5b23f
SSDEEP 12288:/M5REAfL3aKHx5r+TuxXzNWJBhiFHzsVK2okHANUTNCte:/M5RE23aKHx5r+TuxXzcBsFHUoFte
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Gh0st RAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

489814

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WriteFile SetFilePointer GetModuleFileNameA OpenProcess SetFileAttributesA CopyFileA GlobalAlloc GlobalLock GlobalUnlock GetStartupInfoA WaitForSingleObject GetLastError CloseHandle EnterCriticalSection DeleteCriticalSection InitializeCriticalSection MultiByteToWideChar DeviceIoControl GetVersion LocalAlloc FindClose GetVolumeInformationA GetFileAttributesA CreateDirectoryA DeleteFileA GetPrivateProfileStringA FreeLibrary lstrcatA GetPrivateProfileSectionNamesA lstrlenA InterlockedExchange lstrcpyA WideCharToMultiByte LoadLibraryA GetProcAddress RaiseException GetModuleHandleA

gdi32

GetDIBits DeleteDC DeleteObject CreateDIBSection SelectObject CreateCompatibleBitmap

advapi32

LsaClose RegOpenKeyA RegCreateKeyExA RegSetValueExA RegDeleteKeyA RegEnumValueA LsaOpenPolicy OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges OpenEventLogA ClearEventLogA CloseEventLog RegQueryValueA RegOpenKeyExA RegCloseKey LsaFreeMemory IsValidSid

shell32

SHGetSpecialFolderPathA

ole32

CoInitialize CoUninitialize CoCreateInstance CoTaskMemFree

oleaut32

SysFreeString

msvcrt

_CxxThrowException strlen ??1exception@@UAE@XZ _strcmpi _strnset _strnicmp ??2@YAPAXI@Z ??3@YAXPAX@Z __CxxFrameHandler memmove ceil _ftol strstr _purecall strchr malloc free _except_handler3 strrchr fclose fwrite fopen exit atoi strncmp strncpy _errno wcscpy strncat sprintf _beginthreadex vsprintf calloc __dllonexit _onexit _exit _XcptFilter _acmdln __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _controlfp ??0exception@@QAE@ABQBD@Z memcpy ??0exception@@QAE@ABV0@@Z ??1type_info@@UAE@XZ

winmm

waveInOpen waveInGetNumDevs waveOutPrepareHeader waveInPrepareHeader waveInStop waveOutWrite waveInAddBuffer waveInStart waveOutOpen waveOutClose waveOutUnprepareHeader waveOutReset waveInReset waveInUnprepareHeader waveOutGetNumDevs waveInClose

ws2_32

select send inet_ntoa closesocket getsockname bind getpeername accept listen sendto recvfrom __WSAFDIsSet gethostname recv ntohs socket WSAStartup WSACleanup gethostbyname htons connect setsockopt WSAIoctl inet_addr

netapi32

NetUserAdd NetLocalGroupAddMembers

wtsapi32

WTSFreeMemory