Behavioral task
behavioral1
Sample
0efc4340b43c89fd547b516c054f964e_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
0efc4340b43c89fd547b516c054f964e_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
0efc4340b43c89fd547b516c054f964e_JaffaCakes118
-
Size
115KB
-
MD5
0efc4340b43c89fd547b516c054f964e
-
SHA1
77c99d6d1689bd2ff6bfc999c13a98624ab51da0
-
SHA256
e2b8c661fa90ba84cccfb0a8b7657e42e50160a515188a1c38e5e06848557b6f
-
SHA512
fa517f5773a9a222d8ac4b657d968dda14a9c59abd1e0f81302253d61db4f91ff78082b74da2ff46bbd4b408c97bf1242baac1e52b377a61f58fda951a6e34f3
-
SSDEEP
3072:0F0xRInoVxzrf5R/O69EvNAYWxcbV9YR8vJF:0CxRIoV9/OS0NfWxcXrvJF
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 0efc4340b43c89fd547b516c054f964e_JaffaCakes118
Files
-
0efc4340b43c89fd547b516c054f964e_JaffaCakes118.exe windows:4 windows x86 arch:x86
f78af40489ed9670cc35685b3ae1461d
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
msvcrt.dll.
_controlfp
_except_handler3
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
_wcmdln
exit
_XcptFilter
_exit
_mbsstr
__CxxFrameHandler
kernel32
GetProcAddress
GetStartupInfoW
GetModuleHandleW
SetUnhandledExceptionFilter
lstrlenA
GetFileAttributesA
GetTempPathA
lstrcatA
FindResourceA
LoadResource
SystemTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
SizeofResource
SetFileAttributesA
ExitProcess
OutputDebugStringA
LoadLibraryA
GetModuleHandleA
Sections
.text Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 336B - Virtual size: 336B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 960B - Virtual size: 960B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
INIT Size: 816B - Virtual size: 804B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 104KB - Virtual size: 104KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 736B - Virtual size: 726B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ