Behavioral task
behavioral1
Sample
5409f049386fbeeeeab23573029f7bad_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
5409f049386fbeeeeab23573029f7bad_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
5409f049386fbeeeeab23573029f7bad_JaffaCakes118
-
Size
165KB
-
MD5
5409f049386fbeeeeab23573029f7bad
-
SHA1
f9a21cb59af21e5f273294c96d35b0c8e9a0c3ae
-
SHA256
bb4236720d57a045929eab8c550001174c98c0b2b283b3b61a3bdef9ca4e528c
-
SHA512
4afb71442ba242c256990692417db4fa7bd8052a484a239cdf5024834fe11740be98f21dc49b76d0147bd07d0ef323bbb87826a90ee950eeb42184cbe2972d8c
-
SSDEEP
3072:ShLC1yLwatoGmbHMUqp+EzsU9G03+kZDDXl6+k1U2zbfKkoaT5:ShLCEsvjbHMUqTsyZB9Llx2Rzbiko
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 5409f049386fbeeeeab23573029f7bad_JaffaCakes118
Files
-
5409f049386fbeeeeab23573029f7bad_JaffaCakes118.exe windows:4 windows x86 arch:x86
4322a0e2e403795d38c11502eaafcb9f
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
LCMapStringW
GetStringTypeA
SetPriorityClass
GetCurrentThread
SetThreadPriority
FindResourceA
ExitProcess
LoadLibraryA
GetLastError
HeapAlloc
GetModuleHandleA
GetProcAddress
HeapFree
LCMapStringA
RtlUnwind
HeapReAlloc
RaiseException
GetStartupInfoA
GetCommandLineA
GetVersion
VirtualFree
VirtualAlloc
IsBadWritePtr
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
CloseHandle
WriteFile
SetUnhandledExceptionFilter
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WideCharToMultiByte
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
SetStdHandle
FlushFileBuffers
SetFilePointer
CreateFileA
IsBadReadPtr
IsBadCodePtr
GetCPInfo
GetACP
GetOEMCP
SetEndOfFile
ReadFile
MultiByteToWideChar
GetStringTypeW
user32
wsprintfA
GetInputState
advapi32
OpenServiceA
StartServiceA
OpenSCManagerA
CreateServiceA
CloseServiceHandle
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
Sections
.text Size: 30KB - Virtual size: 29KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 118KB - Virtual size: 120KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ