Overview

overview

10

Static

static

3

JaffaCakes...94.exe

windows7-x64

10

JaffaCakes...94.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_42eaf73f2f59bbc651e405e24a536c94

  • Size

    204KB

  • Sample

    250127-x4ehessmd1

  • MD5

    42eaf73f2f59bbc651e405e24a536c94

  • SHA1

    1289b7e896571d0e0e4650d3b2cce2d51d45b3ff

  • SHA256

    84605e25524dee2be13246aaca5388780e377772a5b3242e2fea0e6d7729b999

  • SHA512

    6cb790e6463ada6df5c1826c736cb177a3a5ca411e836446d624f8e7aca2454570f4eae10e9cf93e4a0c49016ffe33f2a4b7655bd36586bef1fbdac61bf08206

  • SSDEEP

    6144:iUcvqDUK4mCCu6zhXcC66jcCldsAtztgBYh:iNyo07X766Lldsyz5h

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_42eaf73f2f59bbc651e405e24a536c94

    • Size

      204KB

    • MD5

      42eaf73f2f59bbc651e405e24a536c94

    • SHA1

      1289b7e896571d0e0e4650d3b2cce2d51d45b3ff

    • SHA256

      84605e25524dee2be13246aaca5388780e377772a5b3242e2fea0e6d7729b999

    • SHA512

      6cb790e6463ada6df5c1826c736cb177a3a5ca411e836446d624f8e7aca2454570f4eae10e9cf93e4a0c49016ffe33f2a4b7655bd36586bef1fbdac61bf08206

    • SSDEEP

      6144:iUcvqDUK4mCCu6zhXcC66jcCldsAtztgBYh:iNyo07X766Lldsyz5h

    Score
    10/10
    gh0stratdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks