gh0strat | JaffaCakes118_4bbb80e7099b9322b8eb2d7a4e1fb6d1 | Triage

Sharing

General

Target

JaffaCakes118_4bbb80e7099b9322b8eb2d7a4e1fb6d1
Size

109KB
MD5

4bbb80e7099b9322b8eb2d7a4e1fb6d1
SHA1

7932d916fe6ac7c1ac99bd3402b11ba0c02d382a
SHA256

cb831f67bfdfb408fe18ddeacf31a36cb3b3285850d335d68c92bdc7ad8a2f8e
SHA512

7da90717890720a786988805475fb6827f4ed36a7bc86dcda792e650868e2d4287d790307b49d154421a8dc16012afcb06766f2e47705c284e33d918a088d2d9
SSDEEP

1536:QmTUSV4SibNr8YIaT024cKau2f9d0RKd+NvP+mHm:kS2SiyYI924Wug9d0y+lP+mHm

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_4bbb80e7099b9322b8eb2d7a4e1fb6d1

Files

JaffaCakes118_4bbb80e7099b9322b8eb2d7a4e1fb6d1
.dll windows:4 windows x86 arch:x86

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Exports

Exports

BeginProc
EndProc
RunProc
ServiceMain

Sections

.text
Size: 75KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ