Behavioral task
behavioral1
Sample
3cade1e3af30d4523fbec98ae8038d57_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
3cade1e3af30d4523fbec98ae8038d57_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
3cade1e3af30d4523fbec98ae8038d57_JaffaCakes118
-
Size
62KB
-
MD5
3cade1e3af30d4523fbec98ae8038d57
-
SHA1
73bacf286b017e16ec27d3311f1f874a4103f55a
-
SHA256
6422f95dfc78c79681affeaa90889d17b383f981102f481aee448415bce95756
-
SHA512
d4f23883da85b2d3946aa653364e3a9d4562fbe675639e9ee28cc11ec346bec4e7fed0938241ff790842c437d493cf55f3455f129ba3a1edf51a1de1848b0796
-
SSDEEP
1536:+NUKmrOycT4sf1Iesvy0Xvd6pzTf9MWJiM:+CKmrOyM4O1Iesvy7p/f9MWt
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3cade1e3af30d4523fbec98ae8038d57_JaffaCakes118
Files
-
3cade1e3af30d4523fbec98ae8038d57_JaffaCakes118.exe windows:4 windows x86 arch:x86
eb16ecd01f171b0920c0216f07f889c8
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CreateThread
GetCurrentProcessId
HeapAlloc
GetProcessHeap
CreateProcessA
lstrcpyA
TerminateThread
DeleteFileA
lstrcatA
GetSystemDirectoryA
ExitProcess
SetFileAttributesA
GetModuleFileNameA
ReleaseMutex
OpenMutexA
GlobalMemoryStatus
GetLocalTime
OpenEventA
ResumeThread
SetThreadPriority
GetCurrentThread
SetPriorityClass
GetCurrentProcess
GetEnvironmentVariableA
GetShortPathNameA
SetErrorMode
CreateMutexA
WinExec
SetUnhandledExceptionFilter
lstrlenA
CopyFileA
GetCurrentThreadId
WriteFile
CreateFileA
GetStartupInfoA
GetModuleHandleA
GetTickCount
Sleep
CancelIo
InterlockedExchange
SetEvent
ResetEvent
GetLastError
WaitForSingleObject
CloseHandle
CreateEventA
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
FreeLibrary
DeleteCriticalSection
LoadLibraryA
GetProcAddress
GetSystemInfo
user32
CloseDesktop
SetThreadDesktop
OpenInputDesktop
GetUserObjectInformationA
GetThreadDesktop
OpenDesktopA
wsprintfA
advapi32
OpenEventLogA
DeleteService
RegCreateKeyExA
RegSetValueExA
ClearEventLogA
CloseEventLog
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
OpenSCManagerA
RegOpenKeyA
SetServiceStatus
RegisterServiceCtrlHandlerA
StartServiceCtrlDispatcherA
CloseServiceHandle
StartServiceA
CreateServiceA
OpenServiceA
msvcrt
_exit
_controlfp
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
??3@YAXPAX@Z
memmove
ceil
_ftol
strstr
__CxxFrameHandler
??2@YAPAXI@Z
_CxxThrowException
rand
sprintf
srand
time
strrchr
malloc
puts
realloc
localtime
atoi
exit
strncmp
_except_handler3
_beginthreadex
calloc
free
??1type_info@@UAE@XZ
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
ws2_32
setsockopt
htons
gethostbyname
WSAIoctl
select
recv
closesocket
send
inet_addr
connect
sendto
WSASocketA
htonl
getsockname
WSACleanup
WSAStartup
socket
Sections
.Buffer Size: 1024B - Virtual size: 960B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Socket Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.text Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.DDos Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Kernel Size: 1024B - Virtual size: 960B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.Manager Size: 512B - Virtual size: 128B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 7KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 10KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE