General

  • Target

    82a8705385370d12c83f585a25ce6050_JaffaCakes118

  • Size

    1.7MB

  • Sample

    241031-lw7cpatrgz

  • MD5

    82a8705385370d12c83f585a25ce6050

  • SHA1

    7abaaeaa09b2d66a7cb5172dc8d91592adb42bd4

  • SHA256

    4699b60653e72407b3c53fc424a6a5eec3d4631e07a937e44daa5b98dcd71faa

  • SHA512

    bb245c86abac82f6c58ca1300398792ef403317369ee9b98287ac4bf7e09bb79f0748902b5a870d634a15ed7eea0259aff710d1db302fef7ee71cc5837628bbd

  • SSDEEP

    49152:YlG4t9WxSrLb1e6UC77FRNgm6fQ6WcTze5EPMZoAr:YlG4tmSrL0KTN51CAr

Malware Config

Targets

    • Target

      82a8705385370d12c83f585a25ce6050_JaffaCakes118

    • Size

      1.7MB

    • MD5

      82a8705385370d12c83f585a25ce6050

    • SHA1

      7abaaeaa09b2d66a7cb5172dc8d91592adb42bd4

    • SHA256

      4699b60653e72407b3c53fc424a6a5eec3d4631e07a937e44daa5b98dcd71faa

    • SHA512

      bb245c86abac82f6c58ca1300398792ef403317369ee9b98287ac4bf7e09bb79f0748902b5a870d634a15ed7eea0259aff710d1db302fef7ee71cc5837628bbd

    • SSDEEP

      49152:YlG4t9WxSrLb1e6UC77FRNgm6fQ6WcTze5EPMZoAr:YlG4tmSrL0KTN51CAr

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • Gh0strat family

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks