General

  • Target

    506f5619d9c69a938f2835e752b6e9f9_JaffaCakes118

  • Size

    316KB

  • Sample

    241017-demb7ayfqh

  • MD5

    506f5619d9c69a938f2835e752b6e9f9

  • SHA1

    7d031226ca1625faf8dbb28a176dea1cb9585ebb

  • SHA256

    b85f096c2b5b51840014d1689b9f160187580d2fbfaeb2adfe9d45ed3d9f2129

  • SHA512

    442169f1b90e54d0bc0bd9c5c13c73ae973ff427d9d56bc6d348ee59e350258b183bf4b22569e406016794fa03f003690dde30057177e4e3387da9da7e686bcb

  • SSDEEP

    6144:GZbXGgeRu/HYMDUkR3GKvf8QLBBzAM+GuN8QpKPOEq:GZjGgeRu1DUIlLbzL+jk+

Malware Config

Targets

    • Target

      506f5619d9c69a938f2835e752b6e9f9_JaffaCakes118

    • Size

      316KB

    • MD5

      506f5619d9c69a938f2835e752b6e9f9

    • SHA1

      7d031226ca1625faf8dbb28a176dea1cb9585ebb

    • SHA256

      b85f096c2b5b51840014d1689b9f160187580d2fbfaeb2adfe9d45ed3d9f2129

    • SHA512

      442169f1b90e54d0bc0bd9c5c13c73ae973ff427d9d56bc6d348ee59e350258b183bf4b22569e406016794fa03f003690dde30057177e4e3387da9da7e686bcb

    • SSDEEP

      6144:GZbXGgeRu/HYMDUkR3GKvf8QLBBzAM+GuN8QpKPOEq:GZjGgeRu1DUIlLbzL+jk+

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

MITRE ATT&CK Enterprise v15

Tasks