gh0strat | 3f6ff4c8b9fe9c85ca728cb7fc1dc0a0_JaffaCakes118

General

Target

3f6ff4c8b9fe9c85ca728cb7fc1dc0a0_JaffaCakes118
Size

502KB
MD5

3f6ff4c8b9fe9c85ca728cb7fc1dc0a0
SHA1

168bb55b1ae21e85f60d618d302d5f9a3bed811b
SHA256

a6dfca2d9f0cee9ab5d6f442c51075d78a1c4f23a3300a1152624c6f095abb7c
SHA512

a8ea1b8eec858130ca2d3aff80bb4ba49c4464e6f9e09852290309c2611e65ff6317b897566818ee3298456ffbfe9a0a5750918ace9e17a774ca66c8332e6327
SSDEEP

12288:EpRPM6lNyeSr+TxookfW3B1/jLjFpEUM5:Epi6lNyeSr+TxooksBRjLJaUM5

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3f6ff4c8b9fe9c85ca728cb7fc1dc0a0_JaffaCakes118

Files

3f6ff4c8b9fe9c85ca728cb7fc1dc0a0_JaffaCakes118
.exe windows:4 windows x86 arch:x86

64fd705b30fc5e07d18537a7ae903f82

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

msvcrt

free
_except_handler3
strrchr
exit
atoi
strncmp
strncpy
_errno
wcscpy
strncat
_CxxThrowException
_beginthreadex
sprintf
vsprintf
calloc
malloc
_onexit
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
strchr
_purecall
strstr
??2@YAPAXI@Z
_ftol
ceil
memmove
memcpy
??0exception@@QAE@ABQBD@Z
??1exception@@UAE@XZ
strlen
??0exception@@QAE@ABV0@@Z
_strcmpi
_strnicmp
__CxxFrameHandler
??3@YAXPAX@Z
__dllonexit
??1type_info@@UAE@XZ

kernel32

GetStartupInfoA
GetModuleHandleA
MultiByteToWideChar
LoadLibraryA
GetProcAddress
lstrlenA

user32

CreateWindowExA
DestroyCursor
GetCursorInfo
LoadCursorA

oleaut32

SysFreeString

ws2_32

inet_addr
closesocket
setsockopt
getsockname
bind
getpeername
accept
inet_ntoa
WSAStartup
WSACleanup
sendto
recvfrom
__WSAFDIsSet
select
gethostname
recv
send
ntohs
socket
gethostbyname
connect
htons
listen

Sections

.text
Size: 454KB - Virtual size: 453KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rodata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 481KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 18KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

64fd705b30fc5e07d18537a7ae903f82

Headers

File Characteristics

Imports

msvcrt

kernel32

user32

oleaut32

ws2_32

Sections

.text Size: 454KB - Virtual size: 453KB

.rodata Size: 11KB - Virtual size: 10KB

.data Size: 18KB - Virtual size: 481KB

.rsrc Size: 18KB - Virtual size: 20KB

.text
Size: 454KB - Virtual size: 453KB

.rodata
Size: 11KB - Virtual size: 10KB

.data
Size: 18KB - Virtual size: 481KB

.rsrc
Size: 18KB - Virtual size: 20KB