General

  • Target

    7d609aeabfc7d458ed11ecdfea396ac9_JaffaCakes118

  • Size

    81KB

  • Sample

    241030-bllccsskf1

  • MD5

    7d609aeabfc7d458ed11ecdfea396ac9

  • SHA1

    90f22ed7b071aa0dec5f8b3e342ae00a72563128

  • SHA256

    d1f3c56e5990591bbf45e5a6c03e3e8d4806c4ad1fd432adf172924ede1339f9

  • SHA512

    50979e715166d64c66ee4caa68ab280f172fc0caaf51e405b053542a57db6b04048e2df78f37b56cd52f891b7c56a6a4ca149da1d170de9e6f916a93aae4e6d2

  • SSDEEP

    1536:jXALnC0atiq+9Cc73McaTBFb0bJ+oa/xrpnHTlyojsjxNe22JjIHMt:jXh0hq+Yc7Hf4oa5r5sojsj+oMt

Malware Config

Targets

    • Target

      7d609aeabfc7d458ed11ecdfea396ac9_JaffaCakes118

    • Size

      81KB

    • MD5

      7d609aeabfc7d458ed11ecdfea396ac9

    • SHA1

      90f22ed7b071aa0dec5f8b3e342ae00a72563128

    • SHA256

      d1f3c56e5990591bbf45e5a6c03e3e8d4806c4ad1fd432adf172924ede1339f9

    • SHA512

      50979e715166d64c66ee4caa68ab280f172fc0caaf51e405b053542a57db6b04048e2df78f37b56cd52f891b7c56a6a4ca149da1d170de9e6f916a93aae4e6d2

    • SSDEEP

      1536:jXALnC0atiq+9Cc73McaTBFb0bJ+oa/xrpnHTlyojsjxNe22JjIHMt:jXh0hq+Yc7Hf4oa5r5sojsj+oMt

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • Gh0strat family

    • Adds Run key to start application

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks