Overview

overview

10

Static

static

3

90dea7c6b1...18.exe

windows7-x64

10

90dea7c6b1...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    90dea7c6b1edc5515d7e638748ef407e_JaffaCakes118

  • Size

    95KB

  • Sample

    241123-1smlfaylaw

  • MD5

    90dea7c6b1edc5515d7e638748ef407e

  • SHA1

    2b2b9ecc061b1cc6f7acb38ca2c301bcc7c4cbc6

  • SHA256

    a24b4269996bde42ff6757d2308c3a5f513e372a580d28e1c2df39c241f1170d

  • SHA512

    a792636c7b0286d960c7f7cbd4dff5f622b1f8cffbb1bfeab5b1c2017cb3721a5b4b24277fb891ab00ffb0665e2e5e2c3292ee122dab5f60533482954d763623

  • SSDEEP

    1536:cxEEoFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prvORvMN7:ceE6S4jHS8q/3nTzePCwNUh4E9vAvMN7

Score
10/10
gh0stratbootkitdiscoverypersistencerat

Malware Config

Targets

    • Target

      90dea7c6b1edc5515d7e638748ef407e_JaffaCakes118

    • Size

      95KB

    • MD5

      90dea7c6b1edc5515d7e638748ef407e

    • SHA1

      2b2b9ecc061b1cc6f7acb38ca2c301bcc7c4cbc6

    • SHA256

      a24b4269996bde42ff6757d2308c3a5f513e372a580d28e1c2df39c241f1170d

    • SHA512

      a792636c7b0286d960c7f7cbd4dff5f622b1f8cffbb1bfeab5b1c2017cb3721a5b4b24277fb891ab00ffb0665e2e5e2c3292ee122dab5f60533482954d763623

    • SSDEEP

      1536:cxEEoFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prvORvMN7:ceE6S4jHS8q/3nTzePCwNUh4E9vAvMN7

    Score
    10/10
    gh0stratbootkitdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks