Overview

overview

10

Static

static

3

JaffaCakes...17.exe

windows7-x64

10

JaffaCakes...17.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_4572a395f849eece93bdd2c5071cd717

  • Size

    1.4MB

  • Sample

    250128-bswfxasqgm

  • MD5

    4572a395f849eece93bdd2c5071cd717

  • SHA1

    3e0ea31860f37e744e5b5f45ac98fd8c5eb6f36a

  • SHA256

    69331281556a9da8b0612655a4570935a3239d7bd6943fd5f8e7753fca4d567a

  • SHA512

    4bbc56692b04dbeb54809b582ad0d430901fc7a1d41c32108e392b1172a2f55b79a08074fe15007bbdc4577e8a5b8853b1867e270911cc28892144e7053c66a8

  • SSDEEP

    24576:IpQI7mFPNpDTKGGc//////RTrAR+CEJpk2XUFl+TDWhYeqow8ZWR6eMvDR1IBf/A:IH67Ec//////RTEA8dr+Tqrbw8ZtDsN4

Score
10/10
gh0stratbootkitdiscoverypersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_4572a395f849eece93bdd2c5071cd717

    • Size

      1.4MB

    • MD5

      4572a395f849eece93bdd2c5071cd717

    • SHA1

      3e0ea31860f37e744e5b5f45ac98fd8c5eb6f36a

    • SHA256

      69331281556a9da8b0612655a4570935a3239d7bd6943fd5f8e7753fca4d567a

    • SHA512

      4bbc56692b04dbeb54809b582ad0d430901fc7a1d41c32108e392b1172a2f55b79a08074fe15007bbdc4577e8a5b8853b1867e270911cc28892144e7053c66a8

    • SSDEEP

      24576:IpQI7mFPNpDTKGGc//////RTrAR+CEJpk2XUFl+TDWhYeqow8ZWR6eMvDR1IBf/A:IH67Ec//////RTEA8dr+Tqrbw8ZtDsN4

    Score
    10/10
    gh0stratbootkitdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks