Behavioral task
behavioral1
Sample
JaffaCakes118_43bf4ae0cb3e739749d7e0767b703829.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_43bf4ae0cb3e739749d7e0767b703829.exe
Resource
win10v2004-20241007-en
General
-
Target
JaffaCakes118_43bf4ae0cb3e739749d7e0767b703829
-
Size
38KB
-
MD5
43bf4ae0cb3e739749d7e0767b703829
-
SHA1
36a9e6d0cc45c7f80a7e8f1ca6d0ced384a050e2
-
SHA256
8f7c40cac9366d5c195c56b235f995cbdf284bccc834bd7b0cc8c93398704c90
-
SHA512
53b510acd94b86100ca4487e69405d67a6de048d5b03239c161430ce4f6c917310b20801f734955c70535f1dd822b359e60387b36879dd3e029c816fbbd36d57
-
SSDEEP
768:b8mB/VGShQBFKovz7JtHzyGrx/UcWC2//uD/A:TB/IShZqz7JtHzyIx/U9/u/A
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_43bf4ae0cb3e739749d7e0767b703829
Files
-
JaffaCakes118_43bf4ae0cb3e739749d7e0767b703829.exe windows:4 windows x86 arch:x86
3059b29fb48b6356044ea71716761d14
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetEnvironmentVariableA
GetCommandLineA
CreateMutexA
GetLastError
ReleaseMutex
Sleep
GetModuleFileNameA
SetLastError
lstrcmpiA
lstrlenA
GetModuleHandleA
GetProcAddress
CloseHandle
lstrcatA
GetStartupInfoA
advapi32
RegDeleteKeyA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
StartServiceA
RegCreateKeyExA
RegSetValueExA
RegDeleteValueA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
CreateServiceA
msvcrt
_initterm
realloc
malloc
_except_handler3
strchr
sprintf
strstr
_exit
_XcptFilter
exit
_acmdln
__getmainargs
_stricmp
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_controlfp
Sections
.text Size: 3KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1024B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 32KB - Virtual size: 31KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ