Behavioral task
behavioral1
Sample
JaffaCakes118_3de25756770c7f2cda872cb32a200949.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_3de25756770c7f2cda872cb32a200949
-
Size
9.2MB
-
MD5
3de25756770c7f2cda872cb32a200949
-
SHA1
8bc2d08901872dc3fb88599ac06b2b0cae36189d
-
SHA256
df3b567bd35bf73cfa52fa179acc05e19f794c00bf729cd3ea6ddf276b2372e8
-
SHA512
92aaa490deda8e72ec99ec5a0d1500608285647f54f6c049d1a0235245579efeff5c3219943e8454510acf41307829541115b6977efa52e7352491f8e0392d4b
-
SSDEEP
3072:zFE6I0avDH0d+KU0uZ+LbP100ZIPn7CCIXdO69ln5I8SqI:zF1VavDH0d+K1uYbGvP7/Iso5If
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_3de25756770c7f2cda872cb32a200949
Files
-
JaffaCakes118_3de25756770c7f2cda872cb32a200949.exe windows:4 windows x86 arch:x86
195ae956b916827f20aadf09e4ff0999
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
LoadLibraryA
HeapFree
GetProcessHeap
GetLastError
ExitProcess
WideCharToMultiByte
MultiByteToWideChar
MoveFileA
CloseHandle
lstrlenA
WriteFile
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
CreateFileA
LoadResource
FindResourceA
GetTickCount
GetTempPathA
ReadFile
SetFilePointer
Sleep
SetFileAttributesA
GetModuleHandleA
LockResource
Process32Next
Process32First
GetModuleFileNameA
ReleaseMutex
CreateMutexA
CreateThread
SetUnhandledExceptionFilter
InterlockedExchange
LocalAlloc
FreeLibrary
GetStartupInfoA
RaiseException
shell32
SHFileOperationA
ShellExecuteA
msvcrt
malloc
sprintf
??3@YAXPAX@Z
fclose
fwrite
fopen
strstr
_mkdir
_access
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_initterm
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
_except_handler3
??2@YAPAXI@Z
_strcmpi
Sections
.text Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 141KB - Virtual size: 141KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ