gh0strat | 5a256b49d4ee4da4a463107250d8b7f231fff0d9139750606e1de5e2af6ee0c0 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

JaffaCakes...0e.exe

windows7-x64

JaffaCakes...0e.exe

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_319d95b84ba3cdb5bc5183d1bb4aef0e
Size

117KB
Sample

250228-e7wa8s1sfw
MD5

319d95b84ba3cdb5bc5183d1bb4aef0e
SHA1

5c4e862a2ffed5fc1b12908fc09c6e3caa9d9779
SHA256

5a256b49d4ee4da4a463107250d8b7f231fff0d9139750606e1de5e2af6ee0c0
SHA512

853da06445640a2ccec3088f41f8a3e983b7282ec3766cc4d9006862c7b050ff67545212b125ae6d9fd3a9e4e291522d49fcdd0b99e94c8b649e43b4e4ea11e9
SSDEEP

3072:J7vQZBvHLukTbqB+KHDkgHRO72ATUFWPm:p4ZBvHLXTUTxObs

Score

10^/10

gh0strat bootkit discovery persistence rat upx

Static task

static1

4 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_319d95b84ba3cdb5bc5183d1bb4aef0e.exe

Resource

win7-20240903-en

gh0strat bootkit discovery persistence rat upx

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_319d95b84ba3cdb5bc5183d1bb4aef0e.exe

Resource

win10v2004-20250217-en

gh0strat discovery rat upx

windows10-2004-x64

10 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_319d95b84ba3cdb5bc5183d1bb4aef0e
- Size
  
  117KB
- MD5
  
  319d95b84ba3cdb5bc5183d1bb4aef0e
- SHA1
  
  5c4e862a2ffed5fc1b12908fc09c6e3caa9d9779
- SHA256
  
  5a256b49d4ee4da4a463107250d8b7f231fff0d9139750606e1de5e2af6ee0c0
- SHA512
  
  853da06445640a2ccec3088f41f8a3e983b7282ec3766cc4d9006862c7b050ff67545212b125ae6d9fd3a9e4e291522d49fcdd0b99e94c8b649e43b4e4ea11e9
- SSDEEP
  
  3072:J7vQZBvHLukTbqB+KHDkgHRO72ATUFWPm:p4ZBvHLXTUTxObs
Score

10^/10

gh0strat bootkit discovery persistence rat upx
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0strat family
  gh0strat
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Privilege Escalation

Defense Evasion

Pre-OS Boot

Bootkit

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gh0stratbootkitdiscoverypersistenceratupx

behavioral2

gh0stratdiscoveryratupx

© 2018-2025

Terms | Privacy