gh0strat | 0cd31d10a236a36eb06fdc647885deba963ba89b2615f5f8d374035d4216fc3f | Triage

Submit
Reports

Overview

overview

Static

static

3

JaffaCakes...07.exe

windows7-x64

JaffaCakes...07.exe

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_3cd57a0095166c3c937737ac70458207
Size

376KB
Sample

250302-bdtc1aypx5
MD5

3cd57a0095166c3c937737ac70458207
SHA1

20496b3588a2806fab0f930cab3f8e346990ea0d
SHA256

0cd31d10a236a36eb06fdc647885deba963ba89b2615f5f8d374035d4216fc3f
SHA512

4867013c1ec55893945f143468ab76dd70412ee902456af5289e5ea781643bf0db35fe61512a08d828b91afe91cb2347d9456f003522f57fe55f1fbe0e9e4bea
SSDEEP

6144:zIHYsZbS31zXqSNQgeiOKnDYVH0pwpMWEmpRBJ1NuUBY+f7zAF11whggaoHofphc:zIVZel6SOgeiOKEVH0ppWfBJ7XBczmRz

Score

10^/10

gh0strat discovery persistence rat

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_3cd57a0095166c3c937737ac70458207.exe

Resource

win7-20240903-en

gh0strat discovery persistence rat

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_3cd57a0095166c3c937737ac70458207.exe

Resource

win10v2004-20250217-en

gh0strat discovery persistence rat

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_3cd57a0095166c3c937737ac70458207
- Size
  
  376KB
- MD5
  
  3cd57a0095166c3c937737ac70458207
- SHA1
  
  20496b3588a2806fab0f930cab3f8e346990ea0d
- SHA256
  
  0cd31d10a236a36eb06fdc647885deba963ba89b2615f5f8d374035d4216fc3f
- SHA512
  
  4867013c1ec55893945f143468ab76dd70412ee902456af5289e5ea781643bf0db35fe61512a08d828b91afe91cb2347d9456f003522f57fe55f1fbe0e9e4bea
- SSDEEP
  
  6144:zIHYsZbS31zXqSNQgeiOKnDYVH0pwpMWEmpRBJ1NuUBY+f7zAF11whggaoHofphc:zIVZel6SOgeiOKEVH0ppWfBJ7XBczmRz
Score

10^/10

gh0strat discovery persistence rat
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0strat family
  gh0strat
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gh0stratdiscoverypersistencerat

behavioral2

gh0stratdiscoverypersistencerat

© 2018-2025

Terms | Privacy