General
-
Target
82a8705385370d12c83f585a25ce6050_JaffaCakes118
-
Size
1.7MB
-
Sample
241031-lw7cpatrgz
-
MD5
82a8705385370d12c83f585a25ce6050
-
SHA1
7abaaeaa09b2d66a7cb5172dc8d91592adb42bd4
-
SHA256
4699b60653e72407b3c53fc424a6a5eec3d4631e07a937e44daa5b98dcd71faa
-
SHA512
bb245c86abac82f6c58ca1300398792ef403317369ee9b98287ac4bf7e09bb79f0748902b5a870d634a15ed7eea0259aff710d1db302fef7ee71cc5837628bbd
-
SSDEEP
49152:YlG4t9WxSrLb1e6UC77FRNgm6fQ6WcTze5EPMZoAr:YlG4tmSrL0KTN51CAr
Static task
static1
Behavioral task
behavioral1
Sample
82a8705385370d12c83f585a25ce6050_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
82a8705385370d12c83f585a25ce6050_JaffaCakes118.exe
Resource
win10v2004-20241007-en
Malware Config
Targets
-
-
Target
82a8705385370d12c83f585a25ce6050_JaffaCakes118
-
Size
1.7MB
-
MD5
82a8705385370d12c83f585a25ce6050
-
SHA1
7abaaeaa09b2d66a7cb5172dc8d91592adb42bd4
-
SHA256
4699b60653e72407b3c53fc424a6a5eec3d4631e07a937e44daa5b98dcd71faa
-
SHA512
bb245c86abac82f6c58ca1300398792ef403317369ee9b98287ac4bf7e09bb79f0748902b5a870d634a15ed7eea0259aff710d1db302fef7ee71cc5837628bbd
-
SSDEEP
49152:YlG4t9WxSrLb1e6UC77FRNgm6fQ6WcTze5EPMZoAr:YlG4tmSrL0KTN51CAr
Score10/10-
Gh0st RAT payload
-
Gh0strat family
-
Checks BIOS information in registry
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-