gh0strat | e2b8c661fa90ba84cccfb0a8b7657e42e50160a515188a1c38e5e06848557b6f | Triage

Submit
Reports

Overview

overview

Static

static

0efc4340b4...18.exe

windows7-x64

0efc4340b4...18.exe

windows10-2004-x64

Sharing

General

Target

0efc4340b43c89fd547b516c054f964e_JaffaCakes118
Size

115KB
Sample

241003-mxkezsxarl
MD5

0efc4340b43c89fd547b516c054f964e
SHA1

77c99d6d1689bd2ff6bfc999c13a98624ab51da0
SHA256

e2b8c661fa90ba84cccfb0a8b7657e42e50160a515188a1c38e5e06848557b6f
SHA512

fa517f5773a9a222d8ac4b657d968dda14a9c59abd1e0f81302253d61db4f91ff78082b74da2ff46bbd4b408c97bf1242baac1e52b377a61f58fda951a6e34f3
SSDEEP

3072:0F0xRInoVxzrf5R/O69EvNAYWxcbV9YR8vJF:0CxRIoV9/OS0NfWxcXrvJF

Score

10^/10

gh0strat discovery persistence rat

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

0efc4340b43c89fd547b516c054f964e_JaffaCakes118.exe

Resource

win7-20240708-en

windows7-x64

2 signatures

150 seconds

Behavioral task

behavioral2

Sample

0efc4340b43c89fd547b516c054f964e_JaffaCakes118.exe

Resource

win10v2004-20240802-en

gh0strat discovery persistence rat

windows10-2004-x64

5 signatures

150 seconds

Malware Config

Targets

- Target
  
  0efc4340b43c89fd547b516c054f964e_JaffaCakes118
- Size
  
  115KB
- MD5
  
  0efc4340b43c89fd547b516c054f964e
- SHA1
  
  77c99d6d1689bd2ff6bfc999c13a98624ab51da0
- SHA256
  
  e2b8c661fa90ba84cccfb0a8b7657e42e50160a515188a1c38e5e06848557b6f
- SHA512
  
  fa517f5773a9a222d8ac4b657d968dda14a9c59abd1e0f81302253d61db4f91ff78082b74da2ff46bbd4b408c97bf1242baac1e52b377a61f58fda951a6e34f3
- SSDEEP
  
  3072:0F0xRInoVxzrf5R/O69EvNAYWxcbV9YR8vJF:0CxRIoV9/OS0NfWxcXrvJF
Score

10^/10

gh0strat rat discovery persistence
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Server Software Component: Terminal Services DLL
  persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

Terminal Services DLL

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

gh0stratdiscoverypersistencerat

© 2018-2025

Terms | Privacy