gh0strat | 80c6d63bde0f3169c02ce9f831cb1973_JaffaCakes118

Sharing

Copy URL Twitter E-mail

General

Target
80c6d63bde0f3169c02ce9f831cb1973_JaffaCakes118
Size 95KB
Sample241031-amaftavckc
SHA256 c15d5e654450b75ad9a72100d3c6e8d936314979f5d1c4c4d2e52437b4f20395
MD5 80c6d63bde0f3169c02ce9f831cb1973
SHA1 d144436ebff824f2dab498ce1c263ef2511ce024
SHA512 22822f537d09656c5e8f9bbff022eb017073ae45b0ca4028fd3acebc05a09d7249ea33f824bf44c33a65879aa4fffed8478b6e67899cd24b696b77d001db82a8
SSDEEP 1536:K4rJnSJx6J0mIN9JMVbr6pchWbtDIgicc4zfa4AOGTw+REb2:K4rJnSyJpbr6Cgif4Ta4AOGTw+REb2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
80c6d63bde0f3169c02ce9f831cb1973_JaffaCakes118

File Explorer

80c6d63bde0f3169c02ce9f831cb1973_JaffaCakes118

.dll 95KB

80c6d63bde0f3169c02ce9f831cb1973_JaffaCakes118

IMPHASH add290eec8da5f37e277c1379d6032b9
SHA256 c15d5e654450b75ad9a72100d3c6e8d936314979f5d1c4c4d2e52437b4f20395
MD5 80c6d63bde0f3169c02ce9f831cb1973
SHA1 d144436ebff824f2dab498ce1c263ef2511ce024
SHA512 22822f537d09656c5e8f9bbff022eb017073ae45b0ca4028fd3acebc05a09d7249ea33f824bf44c33a65879aa4fffed8478b6e67899cd24b696b77d001db82a8
SSDEEP 1536:K4rJnSJx6J0mIN9JMVbr6pchWbtDIgicc4zfa4AOGTw+REb2:K4rJnSyJpbr6Cgif4Ta4AOGTw+REb2
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Gh0st RAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

51984

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

MoveFileExA GetTickCount GetLocalTime HeapFree GetProcessHeap MapViewOfFile CreateFileMappingA HeapAlloc UnmapViewOfFile GlobalFree GlobalUnlock GlobalLock GlobalAlloc GlobalSize GetStartupInfoA CreatePipe OpenProcess GetCurrentProcess PeekNamedPipe WaitForMultipleObjects ReleaseMutex OpenEventA SetErrorMode CreateMutexA SetUnhandledExceptionFilter FreeConsole LocalSize Process32Next Process32First CreateToolhelp32Snapshot lstrcmpiA GetCurrentThreadId RaiseException VirtualAllocEx WriteProcessMemory DisconnectNamedPipe CreateRemoteThread GetSystemDirectoryA SetLastError GetModuleFileNameA MoveFileA WriteFile SetFilePointer ReadFile CreateFileA GetFileSize RemoveDirectoryA LocalAlloc FindFirstFileA LocalReAlloc FindNextFileA LocalFree FindClose GetLogicalDriveStringsA GetVolumeInformationA GetDiskFreeSpaceExA GetDriveTypeA CreateProcessA GetFileAttributesA CreateDirectoryA GetLastError DeleteFileA GetVersionExA GetPrivateProfileStringA lstrcmpA WideCharToMultiByte MultiByteToWideChar LoadLibraryA GetProcAddress FreeLibrary GetWindowsDirectoryA lstrcatA GetPrivateProfileSectionNamesA lstrlenA Sleep CancelIo InterlockedExchange lstrcpyA ResetEvent VirtualAlloc EnterCriticalSection LeaveCriticalSection VirtualFree DeleteCriticalSection InitializeCriticalSection CreateThread CreateEventA ResumeThread SetEvent WaitForSingleObject TerminateThread CloseHandle TerminateProcess

user32

keybd_event MapVirtualKeyA SetCapture WindowFromPoint SetCursorPos mouse_event CloseClipboard SetClipboardData EmptyClipboard GetWindowTextA GetClipboardData GetSystemMetrics SetRect GetDC GetDesktopWindow ReleaseDC GetCursorInfo GetCursorPos SetProcessWindowStation OpenWindowStationA GetProcessWindowStation ExitWindowsEx IsWindow CloseWindow DispatchMessageA GetActiveWindow CallNextHookEx GetKeyNameTextA SetWindowsHookExA UnhookWindowsHookEx LoadCursorA DestroyCursor BlockInput SystemParametersInfoA OpenClipboard SendMessageA TranslateMessage GetMessageA wsprintfA CharNextA CreateWindowExA PostMessageA OpenDesktopA GetThreadDesktop GetUserObjectInformationA OpenInputDesktop SetThreadDesktop CloseDesktop EnumWindows IsWindowVisible GetWindowThreadProcessId

gdi32

CreateDIBSection DeleteObject DeleteDC BitBlt GetDIBits CreateCompatibleBitmap CreateCompatibleDC SelectObject

advapi32

GetTokenInformation LookupAccountSidA SetServiceStatus RegisterServiceCtrlHandlerA RegCreateKeyExA RegDeleteKeyA RegDeleteValueA IsValidSid LookupAccountNameA LsaClose LsaRetrievePrivateData LsaOpenPolicy LsaFreeMemory RegCloseKey RegQueryValueA RegOpenKeyExA CloseServiceHandle DeleteService ControlService QueryServiceStatus OpenServiceA OpenSCManagerA RegSetValueExA RegCreateKeyA RegQueryValueExA RegOpenKeyA CloseEventLog ClearEventLogA OpenEventLogA AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken FreeSid SetSecurityDescriptorDacl AddAccessAllowedAce InitializeAcl GetLengthSid AllocateAndInitializeSid InitializeSecurityDescriptor RegEnumValueA RegEnumKeyExA

shell32

SHGetFileInfoA SHGetSpecialFolderPathA

shlwapi

SHDeleteKeyA

msvcrt

_strnicmp _beginthreadex _strrev ??1type_info@@UAE@XZ calloc _strcmpi wcstombs atoi realloc strncat strncpy strrchr _except_handler3 free malloc strchr _CxxThrowException strstr _ftol ceil memmove __CxxFrameHandler ??3@YAXPAX@Z ??2@YAPAXI@Z

winmm

waveOutPrepareHeader waveOutClose waveOutUnprepareHeader waveOutReset waveInClose waveInUnprepareHeader waveInReset waveInStop waveOutWrite waveInStart waveInAddBuffer waveInPrepareHeader waveInOpen waveInGetNumDevs waveOutOpen waveOutGetNumDevs

ws2_32

WSAStartup WSACleanup WSAIoctl setsockopt connect htons gethostbyname socket ntohs recv closesocket select getsockname send gethostname

msvcp60

?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z ?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?_Xran@std@@YAXXZ ?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z ?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z ?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

imm32

ImmReleaseContext ImmGetContext ImmGetCompositionStringA

msvfw32

ICSeqCompressFrame ICSendMessage ICOpen ICClose ICCompressorFree ICSeqCompressFrameEnd ICSeqCompressFrameStart

psapi

GetModuleFileNameExA EnumProcessModules

wtsapi32

WTSFreeMemory WTSQuerySessionInformationA