Sequencen
Behavioral task
behavioral1
Sample
0b75872da6a1ad13fd568f0e6a2e27dd_JaffaCakes118.dll
Resource
win7-20240903-en
General
-
Target
0b75872da6a1ad13fd568f0e6a2e27dd_JaffaCakes118
-
Size
153KB
-
MD5
0b75872da6a1ad13fd568f0e6a2e27dd
-
SHA1
3e691b6efeb32f5ff001c8dd4586e695642935e5
-
SHA256
ca027ea4970cf94af25cf29d7d99060e2cd9fe11f32b95592ef8593e56099c8b
-
SHA512
5ac26444f95d55d255c473affb668ed49041628d7c4c27c0e4f6352c8453a82b8f6d6a50c3ec1d95821b09881015f90c8f2260a0d9e27a823f65b7659ecc559b
-
SSDEEP
3072:gTIOxhijhLiT/RmUsmUZsq4m9Ew8G7lTBfteZYuyiSLkyfXFY:+IODij5ymUgn9Ew80lTBlPl6n
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0b75872da6a1ad13fd568f0e6a2e27dd_JaffaCakes118
Files
-
0b75872da6a1ad13fd568f0e6a2e27dd_JaffaCakes118.dll windows:4 windows x86 arch:x86
38d22e916a4fd7e1ef6f31abd3cdd222
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
user32
CloseWindowStation
LoadCursorA
DestroyCursor
GetCursorInfo
GetClassNameA
GetWindow
ShowWindow
GetWindowRect
CreateWindowExA
DestroyWindow
wvsprintfA
MessageBoxA
wsprintfA
kernel32
RaiseException
GlobalLock
IsBadWritePtr
FormatMessageA
SetUnhandledExceptionFilter
LocalReAlloc
LocalSize
GetExitCodeProcess
ExitProcess
GetLongPathNameA
Sleep
GetCurrentThreadId
CloseHandle
lstrcmpiA
lstrcpyA
GetTempFileNameA
lstrcatA
lstrlenA
GetProcAddress
GetModuleHandleA
InterlockedDecrement
InterlockedIncrement
GetLastError
GetVersionExA
GetTickCount
HeapFree
HeapAlloc
GetProcessHeap
GetSystemInfo
GetProcessTimes
GetCurrentProcess
GlobalMemoryStatusEx
FreeLibrary
GlobalFree
GlobalAlloc
GetSystemDirectoryA
DeleteFileA
RemoveDirectoryA
ExitThread
GetModuleFileNameA
IsBadReadPtr
IsBadStringPtrW
InterlockedExchange
MultiByteToWideChar
WideCharToMultiByte
lstrcmpA
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
ExpandEnvironmentStringsA
InitializeCriticalSection
VirtualFree
LeaveCriticalSection
VirtualAlloc
GetLocalTime
GlobalUnlock
LoadLibraryA
GlobalSize
MapViewOfFile
CreateFileMappingA
GetShortPathNameA
LocalFree
LocalAlloc
VirtualQuery
GetCurrentProcessId
VirtualProtect
SetEnvironmentVariableA
GetTempPathA
advapi32
RegOpenKeyExW
msvcrt
rand
_adjust_fdiv
_initterm
??1type_info@@UAE@XZ
_onexit
__dllonexit
_strupr
_memicmp
_wcsicmp
_strlwr
_CxxThrowException
__CxxFrameHandler
strrchr
malloc
strstr
??3@YAXPAX@Z
??2@YAPAXI@Z
strchr
strncpy
free
_beginthreadex
_except_handler3
atoi
wcslen
srand
_ftol
wcstombs
memmove
ceil
strncat
realloc
wcsrchr
Exports
Exports
Sections
.text Size: 100KB - Virtual size: 97KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 24KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ