Overview

overview

10

Static

static

10

JaffaCakes...ac.exe

windows7-x64

6

JaffaCakes...ac.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_4015c64a57de7262eb13f1d692b804ac

  • Size

    360KB

  • Sample

    250302-n7c94atxbz

  • MD5

    4015c64a57de7262eb13f1d692b804ac

  • SHA1

    5a2e834ec7dcfbafb183ddae920e6b6d901794af

  • SHA256

    f6bd421d9f1d03171902621ba6667fd6c59c3f13771cd972c3cd25f5ca596007

  • SHA512

    0b90b57e420f09859fbb0e4384d8bb577f21c4c715f0a4c78244be5f0d4c8feea5ce690c95b0f7bec9c1c0ec3c13b966f6f6aaec9f44ca71e097b5dadea987a2

  • SSDEEP

    6144:/iTyixB05L7t0J5xp34uGS4G7v4G7AWFH4G7AWF5:qlB05d0rxNNJJAaAW

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_4015c64a57de7262eb13f1d692b804ac

    • Size

      360KB

    • MD5

      4015c64a57de7262eb13f1d692b804ac

    • SHA1

      5a2e834ec7dcfbafb183ddae920e6b6d901794af

    • SHA256

      f6bd421d9f1d03171902621ba6667fd6c59c3f13771cd972c3cd25f5ca596007

    • SHA512

      0b90b57e420f09859fbb0e4384d8bb577f21c4c715f0a4c78244be5f0d4c8feea5ce690c95b0f7bec9c1c0ec3c13b966f6f6aaec9f44ca71e097b5dadea987a2

    • SSDEEP

      6144:/iTyixB05L7t0J5xp34uGS4G7v4G7AWFH4G7AWF5:qlB05d0rxNNJJAaAW

    Score
    10/10
    discoverypersistencegh0stratrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks