Overview

overview

10

Static

static

10

2db1a033d3...18.exe

windows7-x64

10

2db1a033d3...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2db1a033d3f0974c71c389be19576620_JaffaCakes118

  • Size

    209KB

  • Sample

    241009-j3db3sxcnm

  • MD5

    2db1a033d3f0974c71c389be19576620

  • SHA1

    2d33f9ebfe44748a750d6f356125c11712abb13e

  • SHA256

    54c853e55e36974799a679378caf56dba406594ee39e3f3cd62cf55068b60fa4

  • SHA512

    9f73d336df42891278018e64bcf1733cde29d4fee25fcfcb66b5196744c27e44485d2c050ce08a0eca7f830e275917b8d19abe0f8776f81ff3546f34172ab5fd

  • SSDEEP

    3072:3AOFLU1tvzBWHWVKhqvEzO/V1VrNYQkCA+HFSWvF3TBftxnob2AP:3qdWHA9DNYtEHhvF3TBlxnobB

Score
10/10
gh0stratbootkitdiscoverypersistencerat

Malware Config

Targets

    • Target

      2db1a033d3f0974c71c389be19576620_JaffaCakes118

    • Size

      209KB

    • MD5

      2db1a033d3f0974c71c389be19576620

    • SHA1

      2d33f9ebfe44748a750d6f356125c11712abb13e

    • SHA256

      54c853e55e36974799a679378caf56dba406594ee39e3f3cd62cf55068b60fa4

    • SHA512

      9f73d336df42891278018e64bcf1733cde29d4fee25fcfcb66b5196744c27e44485d2c050ce08a0eca7f830e275917b8d19abe0f8776f81ff3546f34172ab5fd

    • SSDEEP

      3072:3AOFLU1tvzBWHWVKhqvEzO/V1VrNYQkCA+HFSWvF3TBftxnob2AP:3qdWHA9DNYtEHhvF3TBlxnobB

    Score
    10/10
    gh0stratbootkitdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks