Overview

overview

10

Static

static

10

3d6b6f6ba4...18.exe

windows7-x64

10

3d6b6f6ba4...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3d6b6f6ba4a4366eddd767c0f81219f8_JaffaCakes118

  • Size

    134KB

  • Sample

    241013-dfxvbawbqd

  • MD5

    3d6b6f6ba4a4366eddd767c0f81219f8

  • SHA1

    636af68f0da1186fcf6d7d464105b7c163739090

  • SHA256

    26aec1cbb07ba1ee713145f26cd24aad7bd7953649ed2060481317b2d53d428f

  • SHA512

    d477323ceb34a8783d048ea6a2bbce0e9be15862de7ebaa38e5769d6f882b4c4a2d880cbf954b11b583fe6b0a8a13eeb9a5bd6a542076bb88d2e8e8a3307964f

  • SSDEEP

    3072:TwZSQpKa3VGVnpUlCz764/9xpEdBqbZuwq5iGeeqovh:+JVGpxx9bKwZuwq4Geeqo

Score
10/10
gh0stratdiscoveryrat

Malware Config

Targets

    • Target

      3d6b6f6ba4a4366eddd767c0f81219f8_JaffaCakes118

    • Size

      134KB

    • MD5

      3d6b6f6ba4a4366eddd767c0f81219f8

    • SHA1

      636af68f0da1186fcf6d7d464105b7c163739090

    • SHA256

      26aec1cbb07ba1ee713145f26cd24aad7bd7953649ed2060481317b2d53d428f

    • SHA512

      d477323ceb34a8783d048ea6a2bbce0e9be15862de7ebaa38e5769d6f882b4c4a2d880cbf954b11b583fe6b0a8a13eeb9a5bd6a542076bb88d2e8e8a3307964f

    • SSDEEP

      3072:TwZSQpKa3VGVnpUlCz764/9xpEdBqbZuwq5iGeeqovh:+JVGpxx9bKwZuwq4Geeqo

    Score
    10/10
    gh0stratdiscoveryrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Deletes itself

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks