Overview

overview

10

Static

static

10

JaffaCakes...72.exe

windows7-x64

10

JaffaCakes...72.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_3e1241327a2a6ae00e374de927e99772

  • Size

    436KB

  • Sample

    250302-ftqdhawkx7

  • MD5

    3e1241327a2a6ae00e374de927e99772

  • SHA1

    de8007c15ea87af113c0f15dbc93b3cc580f4739

  • SHA256

    b8e8913448c5d7c21239afbcdda4d333fd4639b3de65e154f3f9bf00047e9e49

  • SHA512

    43968b0e5419aff2cabcd8f6716f40b47fdd2c157c8ae238666d1d1dfc98e918b46092880d0ac53fe5df4057e33dae156f7f3a35e0efcc3d53e195803f102d77

  • SSDEEP

    6144:wiTti+B0bL7tNI5gp3CBE0V4G7a4G7vWFta4G7vWFy8I+ZC:/PB0bdNYgNU9MvVvvj+ZC

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_3e1241327a2a6ae00e374de927e99772

    • Size

      436KB

    • MD5

      3e1241327a2a6ae00e374de927e99772

    • SHA1

      de8007c15ea87af113c0f15dbc93b3cc580f4739

    • SHA256

      b8e8913448c5d7c21239afbcdda4d333fd4639b3de65e154f3f9bf00047e9e49

    • SHA512

      43968b0e5419aff2cabcd8f6716f40b47fdd2c157c8ae238666d1d1dfc98e918b46092880d0ac53fe5df4057e33dae156f7f3a35e0efcc3d53e195803f102d77

    • SSDEEP

      6144:wiTti+B0bL7tNI5gp3CBE0V4G7a4G7vWFta4G7vWFy8I+ZC:/PB0bdNYgNU9MvVvvj+ZC

    Score
    10/10
    gh0stratdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks