Overview

overview

10

Static

static

10

JaffaCakes...a1.exe

windows7-x64

10

JaffaCakes...a1.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_3e40b5cc39a894dfa26dd093832d6ba1

  • Size

    148KB

  • Sample

    250302-gf5rpswydt

  • MD5

    3e40b5cc39a894dfa26dd093832d6ba1

  • SHA1

    f5a646111337daa205b666167c4a45d1a0bf4c7d

  • SHA256

    34ee1fc5ba2591e0b922681c4db53c2e8053e017286ec84ec804ca8b6678e67a

  • SHA512

    1b2c2216dc43301a25d4815f1b09da1a0a1d317b1c5174dc09c907a1a460d2de2e49ac66cbd2d2f6fab0165a028b4143d6101bdff2260ce7e40998f1620bf26f

  • SSDEEP

    3072:Y+mZTnv7VcsHTZUCieA/HG3/sw+H/lyII0lkvv:tYTnp9U3eim3j+4II0ls

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_3e40b5cc39a894dfa26dd093832d6ba1

    • Size

      148KB

    • MD5

      3e40b5cc39a894dfa26dd093832d6ba1

    • SHA1

      f5a646111337daa205b666167c4a45d1a0bf4c7d

    • SHA256

      34ee1fc5ba2591e0b922681c4db53c2e8053e017286ec84ec804ca8b6678e67a

    • SHA512

      1b2c2216dc43301a25d4815f1b09da1a0a1d317b1c5174dc09c907a1a460d2de2e49ac66cbd2d2f6fab0165a028b4143d6101bdff2260ce7e40998f1620bf26f

    • SSDEEP

      3072:Y+mZTnv7VcsHTZUCieA/HG3/sw+H/lyII0lkvv:tYTnp9U3eim3j+4II0ls

    Score
    10/10
    gh0stratdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks