gh0strat | 7c46ba9f3e9cf4749e21247b6033d7a5_JaffaCakes118

General

Target
7c46ba9f3e9cf4749e21247b6033d7a5_JaffaCakes118
Size 132KB
Sample241029-vrtepsxdpj
SHA256 b01aa47fc1c1d4726f0119178430bd14aa4962e4f5bcbab5d91a2d250ab79859
MD5 7c46ba9f3e9cf4749e21247b6033d7a5
SHA1 9bccc8f657b6cd08ff39f4ec046b3df6f0e6b393
SHA512 67a0253b6edf3995dfcc8da61c0ac17c3a6ef7e23ecfebe5cceee42b9604178babb986104bdce9471035340332bc80c0a781c9520d89670ad1d2d4b3f2b70bc3
SSDEEP 1536:aEu8/KTbCA/Z9vd1C+XgcdD7fCO+spnGYFF3I2Z6gImF8mTy57:vuXbNhRXgCDLCO+stHFP6gImFXTy57
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7c46ba9f3e9cf4749e21247b6033d7a5_JaffaCakes118

File Explorer

7c46ba9f3e9cf4749e21247b6033d7a5_JaffaCakes118

.exe 132KB

7c46ba9f3e9cf4749e21247b6033d7a5_JaffaCakes118

IMPHASH d263d9238f7f5e010da899c09335e096
SHA256 b01aa47fc1c1d4726f0119178430bd14aa4962e4f5bcbab5d91a2d250ab79859
MD5 7c46ba9f3e9cf4749e21247b6033d7a5
SHA1 9bccc8f657b6cd08ff39f4ec046b3df6f0e6b393
SHA512 67a0253b6edf3995dfcc8da61c0ac17c3a6ef7e23ecfebe5cceee42b9604178babb986104bdce9471035340332bc80c0a781c9520d89670ad1d2d4b3f2b70bc3
SSDEEP 1536:aEu8/KTbCA/Z9vd1C+XgcdD7fCO+spnGYFF3I2Z6gImF8mTy57:vuXbNhRXgCDLCO+stHFP6gImFXTy57
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Gh0st RAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

74116

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateEventA CloseHandle TerminateThread SetEvent GetProcAddress LoadLibraryA ResumeThread CreateThread InitializeCriticalSection DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc ResetEvent lstrcpyA GetPrivateProfileSectionNamesA lstrcatA GetWindowsDirectoryA FreeLibrary MultiByteToWideChar WideCharToMultiByte lstrcmpA GetPrivateProfileStringA GetVersionExA CreateDirectoryA GetFileAttributesA GetDriveTypeA GetDiskFreeSpaceExA GetVolumeInformationA GetLogicalDriveStringsA FindClose FindNextFileA FindFirstFileA RemoveDirectoryA WriteFile OpenProcess WaitForSingleObject Sleep GetLocalTime GetTickCount GlobalMemoryStatusEx CreateMutexA ExitProcess lstrlenA GlobalFree GlobalUnlock GlobalLock GlobalAlloc GlobalSize CreatePipe DisconnectNamedPipe PeekNamedPipe CreateToolhelp32Snapshot GetLastError lstrcmpiA RaiseException InterlockedExchange LocalAlloc GetStartupInfoA GetModuleHandleA

msvcrt

strstr _CxxThrowException strchr malloc free _except_handler3 strrchr rename strncpy atoi strncmp _errno _snprintf exit strncat _beginthreadex calloc ??1type_info@@UAE@XZ __dllonexit _onexit _exit _XcptFilter _acmdln __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _controlfp _ftol ceil memmove __CxxFrameHandler ??3@YAXPAX@Z ??2@YAPAXI@Z _strnicmp _strupr _strcmpi ??0exception@@QAE@ABV0@@Z strlen ??1exception@@UAE@XZ ??0exception@@QAE@ABQBD@Z memcpy

Sharing