gh0strat | 692e3ee871b2bf106bde0999b05b87cdaa54f607399ab662a8cf311e66cc524e | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

JaffaCakes...3b.exe

windows7-x64

JaffaCakes...3b.exe

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_389e2d7a5506cd415a52911097b0033b
Size

192KB
Sample

250301-m4lxdsyxfz
MD5

389e2d7a5506cd415a52911097b0033b
SHA1

233e09b535f5bf306aca65091ddccb90626e36bf
SHA256

692e3ee871b2bf106bde0999b05b87cdaa54f607399ab662a8cf311e66cc524e
SHA512

67bb2c6daac576f426e635480c6ab93bd5af3c4d3b34ef9d44d73770d1ab8063e709300b93884a60351c3be365edd91a6e502105c318589678daa3944a2d12fb
SSDEEP

3072:h1il1aIwVZJb+bt5HClWme7s6guy0By1wZwSlbG7hC1sQvJuc:hsaIwVub7HCQry0BTZwWGdC1ssJu

Score

10^/10

gh0strat bootkit discovery persistence rat

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_389e2d7a5506cd415a52911097b0033b.exe

Resource

win7-20240903-en

gh0strat bootkit discovery persistence rat

windows7-x64

15 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_389e2d7a5506cd415a52911097b0033b.exe

Resource

win10v2004-20250217-en

gh0strat bootkit discovery persistence rat

windows10-2004-x64

14 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_389e2d7a5506cd415a52911097b0033b
- Size
  
  192KB
- MD5
  
  389e2d7a5506cd415a52911097b0033b
- SHA1
  
  233e09b535f5bf306aca65091ddccb90626e36bf
- SHA256
  
  692e3ee871b2bf106bde0999b05b87cdaa54f607399ab662a8cf311e66cc524e
- SHA512
  
  67bb2c6daac576f426e635480c6ab93bd5af3c4d3b34ef9d44d73770d1ab8063e709300b93884a60351c3be365edd91a6e502105c318589678daa3944a2d12fb
- SSDEEP
  
  3072:h1il1aIwVZJb+bt5HClWme7s6guy0By1wZwSlbG7hC1sQvJuc:hsaIwVub7HCQry0BTZwWGdC1ssJu
Score

10^/10

gh0strat bootkit discovery persistence rat
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0strat family
  gh0strat
- Server Software Component: Terminal Services DLL
  persistence
- Sets service image path in registry
  persistence
- Deletes itself
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Pre-OS Boot

Bootkit

Server Software Component

Terminal Services DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Pre-OS Boot

Bootkit

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gh0stratbootkitdiscoverypersistencerat

behavioral2

gh0stratbootkitdiscoverypersistencerat

© 2018-2025

Terms | Privacy