Behavioral task
behavioral1
Sample
JaffaCakes118_55d6f2735df949e7e1aefc86999cdec1.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_55d6f2735df949e7e1aefc86999cdec1.exe
Resource
win10v2004-20250129-en
General
-
Target
JaffaCakes118_55d6f2735df949e7e1aefc86999cdec1
-
Size
156KB
-
MD5
55d6f2735df949e7e1aefc86999cdec1
-
SHA1
f0b9edb46b19ef05790833de5fffee1fbec4a4b0
-
SHA256
73a01dabbb548cba3555597bf7d226047e43a6f28e32250e5ac22e2795cdf93e
-
SHA512
4e2b32d30ac8f412b00f9893619093bf666fe65c0dede3ec35be6d93f0c6c30c12c1796793d08abeed2b15d388702b935947d97a54c25b152e3c6611ff8b5f59
-
SSDEEP
3072:/wHeSMoBZNhLR3ZqnQBpO3bP94xiqg+o9UzMte4ZiGkh:/wRBRpqncp+B4gn+oezMzcGkh
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_55d6f2735df949e7e1aefc86999cdec1
Files
-
JaffaCakes118_55d6f2735df949e7e1aefc86999cdec1.exe windows:4 windows x86 arch:x86
1674d13ce81cd3cc773e73bf89843898
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetProcAddress
LoadLibraryA
FreeResource
Sleep
SizeofResource
LockResource
LoadResource
FindResourceA
GetTickCount
CreateEventA
lstrlenA
SetFilePointer
GetModuleHandleA
GetLastError
RaiseException
InterlockedExchange
LocalAlloc
GetStartupInfoA
FreeLibrary
msvcrt
__setusermatherr
_adjust_fdiv
__p__commode
__p__fmode
__set_app_type
_except_handler3
_controlfp
_initterm
_acmdln
exit
_XcptFilter
_exit
rand
sprintf
__getmainargs
Sections
.text Size: 4KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 4KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 496B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 140KB - Virtual size: 140KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
.data
-
.rdata
-
.rsrc/CPP/102
-
.rsrc/GROUP_ICON/116
-
.rsrc/ICON/1.ico
-
.rsrc/ICON/2.ico
-
.rsrc/MANIFEST/1.xml
-
.rsrc/string.txt
-
.rsrc/version.txt
-
.text