Analysis
-
max time kernel
94s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
05/10/2024, 06:54
General
-
Target
169ce0fc979b3d07941770b3d0e60b25_JaffaCakes118.exe
-
Size
109KB
-
MD5
169ce0fc979b3d07941770b3d0e60b25
-
SHA1
99032a6e9048d0b13ce19567f6832b1f194d909a
-
SHA256
828f5d8fcd7804d23cf63a102ac1e7fa6bd6602c1690c8909b69569cacf57479
-
SHA512
2d791f2f016cf2b8e26b51a8cc0c9cf81bcfae3dfa1ae7923bca815753364887da8a6a0d7b242ba2b528256971f289a7c47f4fc52d32e5f15eeafc2af5bb03fe
-
SSDEEP
3072:0ocmnxEBsJEgLGv/jAc2U0oQIt1cdqTz/f1BkUaNUE:sgxEBsqgLy/jYs1ku7f12UaO
Score
10/10
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\169ce0fc979b3d07941770b3d0e60b25_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\169ce0fc979b3d07941770b3d0e60b25_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
116KB
-
Filesize
116KB