General

  • Target

    JaffaCakes118_3e19fdf56e2975106fc88e4bb1d96d62

  • Size

    110KB

  • Sample

    250127-k8zmyasqcq

  • MD5

    3e19fdf56e2975106fc88e4bb1d96d62

  • SHA1

    ce15870af3b18691ed9c3a65f006d09a19d02f44

  • SHA256

    8179d4d0e98a6f13b80a50a94159ee67d2007b82a705352993eddd6e266e7412

  • SHA512

    a2a3d339dfd52bdca5c2b3d06a1e5393f08f446ee3f0f3a9f06d0330b5dd9331e0c43856b892a06ae369e1fbfff808317f0e62509ff90c97ab235e236fa3c53e

  • SSDEEP

    3072:OjcmvxEBs20GjoP/q5Ap3cFIDwtlcdq86/f1NkUsRTz:zMxEBshGjE/qnF1lkZSf1CUsd

Malware Config

Targets

    • Target

      JaffaCakes118_3e19fdf56e2975106fc88e4bb1d96d62

    • Size

      110KB

    • MD5

      3e19fdf56e2975106fc88e4bb1d96d62

    • SHA1

      ce15870af3b18691ed9c3a65f006d09a19d02f44

    • SHA256

      8179d4d0e98a6f13b80a50a94159ee67d2007b82a705352993eddd6e266e7412

    • SHA512

      a2a3d339dfd52bdca5c2b3d06a1e5393f08f446ee3f0f3a9f06d0330b5dd9331e0c43856b892a06ae369e1fbfff808317f0e62509ff90c97ab235e236fa3c53e

    • SSDEEP

      3072:OjcmvxEBs20GjoP/q5Ap3cFIDwtlcdq86/f1NkUsRTz:zMxEBshGjE/qnF1lkZSf1CUsd

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

    • Gh0strat family

    • Drops file in Drivers directory

    • Server Software Component: Terminal Services DLL

    • Deletes itself

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks