Overview

overview

10

Static

static

3

JaffaCakes...1a.exe

windows7-x64

10

JaffaCakes...1a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_469a623cf95b01ba60220da7dccfbb1a

  • Size

    93KB

  • Sample

    250128-ef7j7awney

  • MD5

    469a623cf95b01ba60220da7dccfbb1a

  • SHA1

    997e8c83e8d5ffdf81f3729470811ce9ba79ecd4

  • SHA256

    36f8162d8d41854a20bf62d22a931ca4e6932d933a97c9909b07c17f62869129

  • SHA512

    260ea6a1ec3e6b8e7a2a87a6a7985f823145d205791f1f03c68a511f2dcf7b314fc91b1045f1da2e7886139590ab36284a32d94d7d33bc7f2ed7121e4e5a6aba

  • SSDEEP

    1536:fpFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prCSQxr:f/S4jHS8q/3nTzePCwNUh4E90xr

Score
10/10
gh0stratbootkitdiscoverypersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_469a623cf95b01ba60220da7dccfbb1a

    • Size

      93KB

    • MD5

      469a623cf95b01ba60220da7dccfbb1a

    • SHA1

      997e8c83e8d5ffdf81f3729470811ce9ba79ecd4

    • SHA256

      36f8162d8d41854a20bf62d22a931ca4e6932d933a97c9909b07c17f62869129

    • SHA512

      260ea6a1ec3e6b8e7a2a87a6a7985f823145d205791f1f03c68a511f2dcf7b314fc91b1045f1da2e7886139590ab36284a32d94d7d33bc7f2ed7121e4e5a6aba

    • SSDEEP

      1536:fpFusSx9qYMhdFHS8qdydo3nTzhYxJA+CwNUtBZVY9v8prCSQxr:f/S4jHS8q/3nTzePCwNUh4E90xr

    Score
    10/10
    gh0stratbootkitdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks