Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
02/03/2025, 14:22
General
-
Target
JaffaCakes118_40c7978d8f65700f3f1bb5240a904dfd.exe
-
Size
24KB
-
MD5
40c7978d8f65700f3f1bb5240a904dfd
-
SHA1
37c398dc56384b0d73ed405e5d2709136f75e6b4
-
SHA256
2f9e2fde37e741c6897be05b3d4cfc734e44c67ab6625f6db421531ac8106904
-
SHA512
a5192360f8b3786ab59935f7dcc809541ba886cd45779e91a0aef3e2bc96c699933c2cb58da0e5f406a6f66e19231699d4fc13c4be4d9531b7f580e4ac83b85c
-
SSDEEP
384:abXC8SN04eMSIJpZcN39w+Vd61b8VkgUZ5GSWcMZMuVmrys2EACV6I19QGcP:abS8SN01KpZuy+Vd8b8V8xYMuG2EYGcP
Score
10/10
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Drops file in Windows directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40c7978d8f65700f3f1bb5240a904dfd.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_40c7978d8f65700f3f1bb5240a904dfd.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
-
Filesize
32KB