General

  • Target

    4e6c68c95120fbc5373f0ede449ed6ce_JaffaCakes118

  • Size

    188KB

  • Sample

    241016-xdtveszbqm

  • MD5

    4e6c68c95120fbc5373f0ede449ed6ce

  • SHA1

    554f05e9c2bbabe4c916e7217480d3659033e460

  • SHA256

    de982ac0173b42a0f865e8eca044f3224cfd61a5b668359c44058bcc52a4eb34

  • SHA512

    1cc2667a5ec7a1638c40bb9e3f2e1077ca368593d9989851f51c9de8f4cbbf13b9bae2aaa5ed888c982eb66f2bf80cf3198b1d275c4a31b7c213f6851529501b

  • SSDEEP

    3072:M/DuIQNTC8j9/t3JcCGAmTHcMNXYjOH7sGy:M/QTC8x/1JcumzcMNXhbs

Malware Config

Targets

    • Target

      4e6c68c95120fbc5373f0ede449ed6ce_JaffaCakes118

    • Size

      188KB

    • MD5

      4e6c68c95120fbc5373f0ede449ed6ce

    • SHA1

      554f05e9c2bbabe4c916e7217480d3659033e460

    • SHA256

      de982ac0173b42a0f865e8eca044f3224cfd61a5b668359c44058bcc52a4eb34

    • SHA512

      1cc2667a5ec7a1638c40bb9e3f2e1077ca368593d9989851f51c9de8f4cbbf13b9bae2aaa5ed888c982eb66f2bf80cf3198b1d275c4a31b7c213f6851529501b

    • SSDEEP

      3072:M/DuIQNTC8j9/t3JcCGAmTHcMNXYjOH7sGy:M/QTC8x/1JcumzcMNXhbs

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • Deletes itself

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks