gh0strat | 54792a4d63a6c600535e7702a62dda88_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target

54792a4d63a6c600535e7702a62dda88_JaffaCakes118
Size

160KB
MD5

54792a4d63a6c600535e7702a62dda88
SHA1

64488aa60acbe030a7f90fb749208875739a1508
SHA256

db40099c1da75ee585f3368f59b199e9fa493337702fc1cfd5e21a74294456f4
SHA512

4c4ff6cf7e5a021404906066ec406f6546f587481e51764273a73ba4a4f96c1c557e26fea04e55a674202754b6f8da752563b0cbaf21e7d45d8ceef1bfed2396
SSDEEP

3072:ui9sKck4fjKhtoQmy1UyFhRtOdBvk71xG3pXbl/0vRIwLFp3/pNqcRV8vkbneKFC:ui9sKckntoQmy1UyFftOdBM5xG3pXbld

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
54792a4d63a6c600535e7702a62dda88_JaffaCakes118

Files

54792a4d63a6c600535e7702a62dda88_JaffaCakes118
.exe windows:4 windows x86 arch:x86

8b8ee8e8f3c546f8e5431fdd236848d5

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

MoveFileA
GetStartupInfoA
GetModuleHandleA
lstrcatA
GetProcAddress
HeapAlloc
GetCurrentProcessId
FreeLibrary
CreateProcessA
lstrlenA
MultiByteToWideChar
GlobalUnlock
CloseHandle
GetCurrentProcess
GetProcessHeap
CreateThread
GetLocalTime
GetTickCount
Sleep
LoadLibraryA
OpenProcess

user32

wsprintfA
DestroyCursor
EmptyClipboard
OpenClipboard
CloseClipboard
GetSystemMetrics
SetRect
ReleaseDC
SendMessageA
IsWindow
CreateWindowExA
GetCursorInfo
LoadCursorA

gdi32

CreateCompatibleBitmap
GetDIBits
BitBlt
DeleteDC
DeleteObject
CreateCompatibleDC
CreateDIBSection
SelectObject

advapi32

RegCreateKeyA
RegQueryValueA
RegOpenKeyExA
RegQueryValueExA
RegCloseKey
DeleteService
StartServiceA

shell32

SHGetSpecialFolderPathA

msvcrt

__p__commode
__p__fmode
__set_app_type
_controlfp
_strnicmp
_strupr
_strcmpi
??0exception@@QAE@ABV0@@Z
strlen
??1exception@@UAE@XZ
??0exception@@QAE@ABQBD@Z
_adjust_fdiv
__setusermatherr
??2@YAPAXI@Z
??3@YAXPAX@Z
putchar
__CxxFrameHandler
_CxxThrowException
memmove
ceil
_ftol
strstr
rand
sprintf
strncpy
strchr
malloc
free
_except_handler3
strrchr
atoi
wcscpy
strncmp
_errno
exit
strncat
atol
_beginthreadex
calloc
??1type_info@@UAE@XZ
__dllonexit
_onexit
_exit
_XcptFilter
_acmdln
__getmainargs
_initterm
memcpy

ws2_32

accept
listen
__WSAFDIsSet
gethostname
htons
WSAIoctl
recv
select
WSACleanup
WSAStartup
bind
getsockname
ntohs
inet_ntoa
htonl
WSASocketA
setsockopt
sendto
closesocket
inet_addr
send
socket
connect
gethostbyname
getpeername

netapi32

NetUserAdd
NetLocalGroupAddMembers

msvfw32

ICSeqCompressFrame
ICSeqCompressFrameEnd
ICCompressorFree
ICClose
ICOpen
ICSendMessage
ICSeqCompressFrameStart

Sections

.text
Size: 124KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8b8ee8e8f3c546f8e5431fdd236848d5

Headers

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

msvcrt

ws2_32

netapi32

msvfw32

Sections

.text Size: 124KB - Virtual size: 120KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 16KB - Virtual size: 18KB

.rsrc Size: 4KB - Virtual size: 1KB

.text
Size: 124KB - Virtual size: 120KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 16KB - Virtual size: 18KB

.rsrc
Size: 4KB - Virtual size: 1KB