Overview

overview

10

Static

static

3

b0dc9c026e...18.exe

windows7-x64

10

b0dc9c026e...18.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b0dc9c026e0c04ed4b50ac081e0bf148_JaffaCakes118

  • Size

    272KB

  • Sample

    241129-na5yvaslaz

  • MD5

    b0dc9c026e0c04ed4b50ac081e0bf148

  • SHA1

    72736ce08f8cce08fef36aa2a5c2fa7b882bf8f4

  • SHA256

    51a26c737f867c1fa08224beeff8a7ab46f2590548626295c6b732f32093fce9

  • SHA512

    aeae36b2d23d5cec3dbc1960fa51fe7b4f632ba1ff43a0b0080857426652af6fc9d24377c03e887470382a3408bfb0799ca53b6864ee013e2cc2cdc5a47b8df4

  • SSDEEP

    6144:hsLYlwIge/+9FR1eTboMMZDYDKvf8QLBBzAM+GBtuL:hsLY5ge/ML5DlLbzL+iu

Score
10/10
gh0stratbootkitdefense_evasiondiscoverypersistencerat

Malware Config

Targets

    • Target

      b0dc9c026e0c04ed4b50ac081e0bf148_JaffaCakes118

    • Size

      272KB

    • MD5

      b0dc9c026e0c04ed4b50ac081e0bf148

    • SHA1

      72736ce08f8cce08fef36aa2a5c2fa7b882bf8f4

    • SHA256

      51a26c737f867c1fa08224beeff8a7ab46f2590548626295c6b732f32093fce9

    • SHA512

      aeae36b2d23d5cec3dbc1960fa51fe7b4f632ba1ff43a0b0080857426652af6fc9d24377c03e887470382a3408bfb0799ca53b6864ee013e2cc2cdc5a47b8df4

    • SSDEEP

      6144:hsLYlwIge/+9FR1eTboMMZDYDKvf8QLBBzAM+GBtuL:hsLY5ge/ML5DlLbzL+iu

    Score
    10/10
    gh0stratbootkitdefense_evasiondiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks