gh0strat | JaffaCakes118_416982e3bc2ba706d0d42b3a80299500

Sharing

Copy URL Twitter E-mail

General

Target
JaffaCakes118_416982e3bc2ba706d0d42b3a80299500
Size 205KB
Sample250101-back3sykgw
SHA256 da6cbd42489879760c5dd8e8d7a85e764a4a1c5b75500df04a65fa9c081731d1
MD5 416982e3bc2ba706d0d42b3a80299500
SHA1 b30475bd42c46c99d81d933f479386d6e661fcfe
SHA512 b5a9c13c920a22bed43f5f82ae3c5613beb4a5b4b7b5f6fe63bc6534eccf8cc1db155b2ab7c7773fcc144dfd9dd283659ffa7fa5b82a78959537c2b8d2e3c185
SSDEEP 3072:/hwVMQgpRh5qTsFyTDW2DQ8UK7dPLjNNRwQRWttOn3C:i2Rnh5Es0m2EI7RNYQRWS3C
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_416982e3bc2ba706d0d42b3a80299500

File Explorer

JaffaCakes118_416982e3bc2ba706d0d42b3a80299500

.exe 205KB

JaffaCakes118_416982e3bc2ba706d0d42b3a80299500

IMPHASH 0533f8fc6d242682a6c09fa97fd55f21
SHA256 da6cbd42489879760c5dd8e8d7a85e764a4a1c5b75500df04a65fa9c081731d1
MD5 416982e3bc2ba706d0d42b3a80299500
SHA1 b30475bd42c46c99d81d933f479386d6e661fcfe
SHA512 b5a9c13c920a22bed43f5f82ae3c5613beb4a5b4b7b5f6fe63bc6534eccf8cc1db155b2ab7c7773fcc144dfd9dd283659ffa7fa5b82a78959537c2b8d2e3c185
SSDEEP 3072:/hwVMQgpRh5qTsFyTDW2DQ8UK7dPLjNNRwQRWttOn3C:i2Rnh5Es0m2EI7RNYQRWS3C
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Gh0st RAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

116609

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WaitForSingleObject SetEvent ResumeThread CreateThread InitializeCriticalSection DeleteCriticalSection VirtualFree LeaveCriticalSection EnterCriticalSection VirtualAlloc ResetEvent lstrcpyA InterlockedExchange CancelIo Sleep lstrlenA GetPrivateProfileSectionNamesA lstrcatA GetWindowsDirectoryA FreeLibrary GetProcAddress LoadLibraryA MultiByteToWideChar WideCharToMultiByte lstrcmpA GetPrivateProfileStringA GetVersionExA DeleteFileA GetLastError CreateDirectoryA GetFileAttributesA CreateProcessA WinExec GetDriveTypeA GetDiskFreeSpaceExA GetVolumeInformationA GetLogicalDriveStringsA FindClose LocalFree FindNextFileA LocalReAlloc FindFirstFileA LocalAlloc RemoveDirectoryA GetFileSize CreateFileA ReadFile SetFilePointer WriteFile MoveFileA LockResource LoadResource FindResourceA GetModuleFileNameA SetLastError GetSystemDirectoryA GetLocalTime OutputDebugStringA EndUpdateResourceA UpdateResourceA BeginUpdateResourceA CopyFileA TerminateThread GetComputerNameA GetTickCount GetCurrentProcess OpenProcess Process32Next Process32First CreateToolhelp32Snapshot ExitProcess DuplicateHandle HeapFree HeapAlloc LocalSize GlobalFree GlobalUnlock GlobalLock GlobalAlloc GlobalSize GetStartupInfoA CreatePipe DisconnectNamedPipe TerminateProcess GlobalMemoryStatus GetSystemInfo lstrlenW GetModuleHandleA GetCurrentProcessId GetSystemDefaultLCID GetCurrentDirectoryA ReleaseMutex OpenEventA SetErrorMode MoveFileExA SetPriorityClass CreateMutexA GetTempPathA GetCurrentThreadId lstrcmpiA LCMapStringW LCMapStringA FlushFileBuffers SetStdHandle GetStringTypeW GetStringTypeA IsBadCodePtr CloseHandle GlobalMemoryStatusEx CreateEventA RtlUnwind RaiseException HeapReAlloc InterlockedDecrement InterlockedIncrement TlsSetValue TlsGetValue ExitThread GetCommandLineA GetVersion TlsAlloc SetUnhandledExceptionFilter GetEnvironmentVariableA HeapDestroy HeapCreate IsBadWritePtr HeapSize GetCPInfo GetACP GetOEMCP UnhandledExceptionFilter FreeEnvironmentStringsA FreeEnvironmentStringsW GetEnvironmentStrings GetEnvironmentStringsW SetHandleCount GetStdHandle GetFileType IsBadReadPtr

ole32

CoUninitialize CoInitialize CoCreateInstance

oleaut32

SysFreeString VariantClear

netapi32

NetUserAdd NetLocalGroupAddMembers

msvcrt

??0exception@@QAE@ABQBD@Z ??1exception@@UAE@XZ ??0exception@@QAE@ABV0@@Z _mkdir _strupr _strrev

avicap32

capGetDriverDescriptionA capCreateCaptureWindowA