Behavioral task
behavioral1
Sample
JaffaCakes118_43481ffa3eaedc83e81152db3cb9d373.exe
Resource
win7-20241023-en
General
-
Target
JaffaCakes118_43481ffa3eaedc83e81152db3cb9d373
-
Size
127KB
-
MD5
43481ffa3eaedc83e81152db3cb9d373
-
SHA1
462d9f383e027e7073496ca026926efeab1d10f2
-
SHA256
3ec6d11b01e04f61449e06d32748661b23361b9567a76af5467aa50aa26b26d3
-
SHA512
601a7cb85b39b9d934918c628456974b2842775cb91af6c23b65e650d1b2aa7af8d61df1ce1f25171aaed97fb5584d0cc708add6641a9b81686ad2673675141a
-
SSDEEP
3072:+SPJa6ULtOtrOUe/irWi+wuYHiLcl7ql2:+V3oFFeKrXLufLOq
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_43481ffa3eaedc83e81152db3cb9d373
Files
-
JaffaCakes118_43481ffa3eaedc83e81152db3cb9d373.exe windows:4 windows x86 arch:x86
40bbb16b3dca827f1476c8f2ed912eba
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
CloseHandle
WaitForSingleObject
WideCharToMultiByte
ResetEvent
GetProcAddress
LoadLibraryW
SetEvent
InterlockedExchange
CancelIo
Sleep
DeleteFileW
GetLastError
CreateDirectoryW
GetFileAttributesW
lstrcpyW
lstrlenW
GetDriveTypeW
GetDiskFreeSpaceExW
GetVolumeInformationW
GetLogicalDriveStringsW
FindClose
LocalFree
FindNextFileW
LocalReAlloc
FindFirstFileW
LocalAlloc
RemoveDirectoryW
GetFileSize
CreateFileW
CreateEventW
SetFilePointer
WriteFile
MoveFileW
MoveFileExW
lstrcatW
GetLongPathNameA
GetTempPathA
GetLongPathNameW
GetTempPathW
GetModuleFileNameW
TerminateThread
GetCurrentThreadId
GetComputerNameW
GlobalMemoryStatus
GetVersionExW
ReleaseMutex
CreateMutexW
SetErrorMode
GetTickCount
OpenEventW
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
ReadFile
InitializeCriticalSection
SetEndOfFile
LCMapStringW
LCMapStringA
GetStringTypeW
GetStringTypeA
MultiByteToWideChar
LoadLibraryA
GetOEMCP
GetACP
GetCPInfo
CreateFileA
FlushFileBuffers
SetStdHandle
IsBadCodePtr
IsBadReadPtr
InterlockedIncrement
InterlockedDecrement
GetStartupInfoA
RtlUnwind
RaiseException
HeapFree
HeapAlloc
CreateThread
TlsSetValue
TlsGetValue
ExitThread
GetCommandLineA
GetVersion
ExitProcess
GetModuleHandleA
TlsAlloc
SetLastError
SetUnhandledExceptionFilter
GetModuleFileNameA
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
HeapReAlloc
IsBadWritePtr
TerminateProcess
GetCurrentProcess
HeapSize
UnhandledExceptionFilter
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetEnvironmentStrings
GetEnvironmentStringsW
SetHandleCount
GetStdHandle
GetFileType
user32
OpenDesktopW
GetThreadDesktop
OpenInputDesktop
CloseDesktop
wsprintfW
GetUserObjectInformationW
SetThreadDesktop
CharNextW
advapi32
RegQueryValueExW
RegOpenKeyExW
RegCreateKeyW
RegSetValueExW
RegCloseKey
RegOpenKeyW
shell32
SHGetSpecialFolderPathW
SHGetFileInfoW
ShellExecuteW
ws2_32
WSAIoctl
setsockopt
connect
htons
gethostbyname
socket
select
recv
closesocket
send
getsockname
WSAStartup
WSACleanup
mpr
WNetGetUserW
Sections
.text Size: 75KB - Virtual size: 75KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.scode Size: 512B - Virtual size: 32B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 10KB - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 18KB - Virtual size: 24KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE