Overview

overview

10

Static

static

10

JaffaCakes...21.exe

windows7-x64

10

JaffaCakes...21.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_3c72e49c2c8536795c4f810b976cb421

  • Size

    140KB

  • Sample

    250301-3wsb7swzgt

  • MD5

    3c72e49c2c8536795c4f810b976cb421

  • SHA1

    29047b1a1f022c0686d255a21a6cbf0a2d440466

  • SHA256

    337baaa3b6a4ae0343397dc88efae906e93ab87acbb3c30ca1b1e739c4eaede7

  • SHA512

    f156889da082a4da4b9b5e0effb09e44d8a7c1d65f4367a0354f40b34bd84efa0b054faa7c39e68e3c721d48c1f305de8cf8edc1e8eb1e70bde9fdaa63b9840a

  • SSDEEP

    3072:yUg0/yQooDYONuWtu8HkBW9c0o/tSBoi/+zgb9BKf:y0yQosY+n54WGT/tSyi/TBA

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_3c72e49c2c8536795c4f810b976cb421

    • Size

      140KB

    • MD5

      3c72e49c2c8536795c4f810b976cb421

    • SHA1

      29047b1a1f022c0686d255a21a6cbf0a2d440466

    • SHA256

      337baaa3b6a4ae0343397dc88efae906e93ab87acbb3c30ca1b1e739c4eaede7

    • SHA512

      f156889da082a4da4b9b5e0effb09e44d8a7c1d65f4367a0354f40b34bd84efa0b054faa7c39e68e3c721d48c1f305de8cf8edc1e8eb1e70bde9fdaa63b9840a

    • SSDEEP

      3072:yUg0/yQooDYONuWtu8HkBW9c0o/tSBoi/+zgb9BKf:y0yQosY+n54WGT/tSyi/TBA

    Score
    10/10
    gh0stratdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Drops file in Drivers directory

    • Server Software Component: Terminal Services DLL

      persistence

    • Loads dropped DLL

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks