Overview

overview

10

Static

static

10

JaffaCakes...b0.dll

windows7-x64

10

JaffaCakes...b0.dll

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_3cd9723c4732e64ac6b242f9635f65b0

  • Size

    117KB

  • Sample

    250302-bewjrayvdw

  • MD5

    3cd9723c4732e64ac6b242f9635f65b0

  • SHA1

    844cb3c2e8880dc295b9d8e3ff97352990cd044c

  • SHA256

    53e716d3f67a90d7ece77f90d7a13d4a93dbcc66f6b847e4d48aa54e0f54c8c6

  • SHA512

    b3e8ccbba3db864e03398e248334ccb337cf5f21b7650886354c4e24fbcbc1aa7c00114b53ba5bf3adbc8679dbb0d9dc959a54aff3f819820530808e6ab70497

  • SSDEEP

    1536:xtY14iZoAb++Eb8B9+WO9DceTyfDvqqGQz/E2giVf/CcbyYu:s14iZZCZ8B9NO9DJTEDvqU/Ez4f/Xbu

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_3cd9723c4732e64ac6b242f9635f65b0

    • Size

      117KB

    • MD5

      3cd9723c4732e64ac6b242f9635f65b0

    • SHA1

      844cb3c2e8880dc295b9d8e3ff97352990cd044c

    • SHA256

      53e716d3f67a90d7ece77f90d7a13d4a93dbcc66f6b847e4d48aa54e0f54c8c6

    • SHA512

      b3e8ccbba3db864e03398e248334ccb337cf5f21b7650886354c4e24fbcbc1aa7c00114b53ba5bf3adbc8679dbb0d9dc959a54aff3f819820530808e6ab70497

    • SSDEEP

      1536:xtY14iZoAb++Eb8B9+WO9DceTyfDvqqGQz/E2giVf/CcbyYu:s14iZZCZ8B9NO9DJTEDvqU/Ez4f/Xbu

    Score
    10/10
    gh0stratdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Server Software Component: Terminal Services DLL

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks