Overview

overview

10

Static

static

3

JaffaCakes...0e.exe

windows7-x64

10

JaffaCakes...0e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_38a56ba71251474c7b572e46de821e0e

  • Size

    466KB

  • Sample

    250301-m7xs3azm12

  • MD5

    38a56ba71251474c7b572e46de821e0e

  • SHA1

    e83595fe00383dc8471f7106b47bf09e23e941d1

  • SHA256

    50769aa72a83dca80caa534d1931ecc5876136108432aa409ceb2c00130bd3a4

  • SHA512

    5d505182603b853b9a8a4c0c039b626d912841c94cbe6ffdf98cb4928802e09912b1cabdd6bd8029e699a6b85939b328c26d3dc2f43b291c1f4ddd8344f67683

  • SSDEEP

    6144:7evzV8Yct6Ym5OjI6UOwqdC32bAAzMFB/:7e7V8rzmb6URlizUB/

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_38a56ba71251474c7b572e46de821e0e

    • Size

      466KB

    • MD5

      38a56ba71251474c7b572e46de821e0e

    • SHA1

      e83595fe00383dc8471f7106b47bf09e23e941d1

    • SHA256

      50769aa72a83dca80caa534d1931ecc5876136108432aa409ceb2c00130bd3a4

    • SHA512

      5d505182603b853b9a8a4c0c039b626d912841c94cbe6ffdf98cb4928802e09912b1cabdd6bd8029e699a6b85939b328c26d3dc2f43b291c1f4ddd8344f67683

    • SSDEEP

      6144:7evzV8Yct6Ym5OjI6UOwqdC32bAAzMFB/:7e7V8rzmb6URlizUB/

    Score
    10/10
    gh0stratdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks