Behavioral task
behavioral1
Sample
441ad55e1e963ae02fa5de959a71d7ee_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
441ad55e1e963ae02fa5de959a71d7ee_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
441ad55e1e963ae02fa5de959a71d7ee_JaffaCakes118
-
Size
74KB
-
MD5
441ad55e1e963ae02fa5de959a71d7ee
-
SHA1
86cac308f0890253c300dde13f2a9c5c5e083401
-
SHA256
ad54d9ec9303d26c7f2fe4a47bfa6e6a0728fc119a1ab2c05ef7182934dd108a
-
SHA512
1ff71471214abadcfe8e22a250263b27c6c7d61040e301f0828f04d5049c7ab3e76afcfbb22b98168f95b520b382d6a71f859008d7ad9f0334216bd885c418ba
-
SSDEEP
1536:fb0U1BSkH/R575+teS49CcieVMIl2+0fMBQwpkHFW5FWMyv9Rida0kGYGm:n5Z5+tX49ViUM1+0fhbFW5F9q9Rida0i
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule static1/unpack001/out.upx family_gh0strat -
Gh0strat family
-
resource yara_rule sample upx -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource 441ad55e1e963ae02fa5de959a71d7ee_JaffaCakes118 unpack001/out.upx
Files
-
441ad55e1e963ae02fa5de959a71d7ee_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
UPX0 Size: - Virtual size: 96KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 58KB - Virtual size: 60KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 5KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
out.upx.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.rdata Size: 16KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 96KB - Virtual size: 96KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 32KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ