gh0strat | 174d596b9bafca61f1d92154cf5e48c4_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

174d596b9bafca61f1d92154cf5e48c4_JaffaCakes118
Size

70KB
MD5

174d596b9bafca61f1d92154cf5e48c4
SHA1

fb60c8fcc5ce48f614093a1ac3a24862cb08e4fe
SHA256

b0fb4e4d2432413642467de157586f8f89947279ff62f705dc902822224aa5ae
SHA512

d86570f269df509639a44da7a106e3479673a032dac44bf2cf24277e59713efb4b043d208b536a1a95f71ba7ef107ec4d97d2b754f0bcf896c4a80d2bd1edd2f
SSDEEP

1536:O2JByNoPRRaL7LnJGc5Oqfiac4pelgq1XMRX:O2JxaL/nJGWOsiac4pelgqdMRX

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
174d596b9bafca61f1d92154cf5e48c4_JaffaCakes118

Files

174d596b9bafca61f1d92154cf5e48c4_JaffaCakes118
.dll windows:4 windows x86 arch:x86

54a456432d0c4c0df093fab88e0f3934

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

TerminateThread
MoveFileExA
GetTickCount
GetSystemDirectoryA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
OpenProcess
ReleaseMutex
OpenEventA
SetErrorMode
CreateMutexA
SetUnhandledExceptionFilter
FreeConsole
lstrcmpiA
Process32Next
Process32First
CreateToolhelp32Snapshot
GetCurrentThreadId
LoadLibraryA
GetProcAddress
FreeLibrary
VirtualAllocEx
WriteProcessMemory
CreateRemoteThread
GetCurrentProcess
SetLastError
GetModuleFileNameA
MoveFileA
WriteFile
SetFilePointer
ReadFile
CreateFileA
GetFileSize
RemoveDirectoryA
LocalAlloc
FindFirstFileA
LocalReAlloc
FindNextFileA
LocalFree
FindClose
GetLogicalDriveStringsA
GetVolumeInformationA
GetDiskFreeSpaceExA
GetDriveTypeA
lstrcatA
CreateProcessA
lstrlenA
GetFileAttributesA
CreateDirectoryA
GetLastError
DeleteFileA
Sleep
CancelIo
InterlockedExchange
InitializeCriticalSection
SetEvent
lstrcpyA
ResetEvent
WaitForSingleObject
CloseHandle
CreateEventA
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
GetVersionExA

user32

LoadCursorA
DestroyCursor
BlockInput
SystemParametersInfoA
SendMessageA
keybd_event
MapVirtualKeyA
SetCapture
WindowFromPoint
SetCursorPos
mouse_event
CloseClipboard
SetClipboardData
EmptyClipboard
OpenClipboard
GetClipboardData
GetSystemMetrics
SetRect
GetDC
GetDesktopWindow
ReleaseDC
PostMessageA
CharNextA
wsprintfA
OpenDesktopA
GetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
SetThreadDesktop
CloseDesktop
GetProcessWindowStation
OpenWindowStationA
SetProcessWindowStation
GetCursorPos
GetCursorInfo

gdi32

DeleteDC
CreateCompatibleDC
GetDIBits
CreateCompatibleBitmap
BitBlt
DeleteObject
CreateDIBSection
SelectObject

advapi32

CloseServiceHandle
RegOpenKeyExA
RegQueryValueA
RegCloseKey
SetServiceStatus
RegisterServiceCtrlHandlerA
RegCreateKeyExA
RegDeleteKeyA
RegDeleteValueA
DeleteService
ControlService
QueryServiceStatus
OpenServiceA
OpenSCManagerA
RegSetValueExA
RegCreateKeyA
RegQueryValueExA
RegOpenKeyA
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegEnumValueA
RegEnumKeyExA

shell32

SHGetFileInfoA

shlwapi

SHDeleteKeyA

msvcrt

strrchr
_strnicmp
calloc
_beginthreadex
wcstombs
atoi
realloc
strchr
strncat
strncpy
_strcmpi
_except_handler3
malloc
free
??2@YAPAXI@Z
__CxxFrameHandler
strstr
_ftol
ceil
memmove
??3@YAXPAX@Z

ws2_32

closesocket
recv
ntohs
select
htons
connect
setsockopt
send
gethostname
getsockname
gethostbyname
WSAIoctl
WSACleanup
WSAStartup
socket

msvcp60

?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Xran@std@@YAXXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

wininet

InternetCloseHandle
InternetOpenA
InternetOpenUrlA
InternetReadFile

avicap32

capGetDriverDescriptionA

Exports

Exports

Rool
libra
whm

Sections

.text
Size: 52KB - Virtual size: 51KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.karal
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.hhkarl
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.karl
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

54a456432d0c4c0df093fab88e0f3934

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

shlwapi

msvcrt

ws2_32

msvcp60

wininet

avicap32

Exports

Exports

Sections

.text Size: 52KB - Virtual size: 51KB

.karal Size: 1KB - Virtual size: 1KB

.hhkarl Size: 2KB - Virtual size: 2KB

.karl Size: 3KB - Virtual size: 3KB

.data Size: 6KB - Virtual size: 7KB

.rsrc Size: 1024B - Virtual size: 960B

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 52KB - Virtual size: 51KB

.karal
Size: 1KB - Virtual size: 1KB

.hhkarl
Size: 2KB - Virtual size: 2KB

.karl
Size: 3KB - Virtual size: 3KB

.data
Size: 6KB - Virtual size: 7KB

.rsrc
Size: 1024B - Virtual size: 960B

.reloc
Size: 3KB - Virtual size: 2KB