Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20250207-en -
resource tags
-
submitted
01/03/2025, 22:05
General
-
Target
JaffaCakes118_3be35fb0f28a5f841cd6765827785c5e.exe
-
Size
321KB
-
MD5
3be35fb0f28a5f841cd6765827785c5e
-
SHA1
eaddef60d78bc8fcfd426541453b0504748f78c9
-
SHA256
c4a0bb6d9044522198049699b416f78168fa5ac7adcf577de5471a245cfc4af0
-
SHA512
bf88d6f6f69968b84b8fa24630f9fcb044019e4b409a38f8c6801696d68713d2cd7de94b35affaaa4f742d78e17d33bfdd2eb041f6bc7ded4e2ee117c50d7c4b
-
SSDEEP
6144:p7j1MoraeUuq4H4nDWgRAkPUHtGQn8xID0DMF3GqpKHeLu1keWcw1Weqo:p/1/We+1R3PGGLxe0DbdUBceH
Malware Config
Signatures
-
Gh0st RAT payload 6 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Deletes itself 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3be35fb0f28a5f841cd6765827785c5e.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_3be35fb0f28a5f841cd6765827785c5e.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k imgsvc1⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
101KB
MD50c442fcf389301e632c2c5ce2804553e
SHA1117b7727484b3e8d1c3f2505d7093b3876a8ef1b
SHA256c7d1349fe706f0d8d9600b43ff60b7cbcd6246013cf38810e3c201454315faa4
SHA512328135fb8c859137f53c5e5235c551f1c7cefa93be6f84dad6df69113de9dd6370dbcef9f9007fdeb1fe3ff25808fdc460e5691c2628619f2e96910dbc31ae14
-
Filesize
14.9MB
MD52738aef4af136f7cf372b40a69502fea
SHA1f1cb03c83c87ec72adc70cb31d8ed33baee99e22
SHA2566b0b0dede19c143a410db859aa75338b4009c3fbda6289e0adfd50382e504b86
SHA51239ff5f10d2a65f8aa251213ac9b7478e86bda0942d2564c2d1037c5fc3d95afcf0d631e702d4c675543270b85a28e9f00ce87407b1e4ff5cbcaf8226691c4bdc
-
Filesize
98B
MD519913b605b5d408518d9aaba7a332342
SHA14c7183701e56014bf7e8ddc2017b7be830007101
SHA256860fe47d926010906873a576121706d4572e1a0ed19d95d37c1f27ba1b824f36
SHA512b6ada5dd91e859a72cd2705268162b657baf3647d8691782811c5f73a2e1e1b81711b628b7773cc0586b3fd24d3001d3e03805b914a48145387b4122c475124a
-
Filesize
112KB
-
Filesize
1.5MB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
4KB
-
Filesize
480KB
-
Filesize
480KB
-
Filesize
112KB
-
Filesize
480KB
-
Filesize
256KB
-
Filesize
480KB
-
Filesize
1.1MB
-
Filesize
480KB
