Analysis
-
max time kernel
92s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
03/03/2025, 22:53
General
-
Target
JaffaCakes118_499bee2e85e2509e1483ae2e8fd1fd25.exe
-
Size
364KB
-
MD5
499bee2e85e2509e1483ae2e8fd1fd25
-
SHA1
59e745ddbd85ce55c96bb343f0763386595315f7
-
SHA256
178998eb49d3a4aad35b0fcd459478040a6a92ae115102a2c1468bfea52f0325
-
SHA512
f7061d65403895d77b0f7ab767220d09da31c795ca8fe20ad15ebedf102463c29f7b4ea57103f453b02f7b30c036fdf2e1fd694f07541d681a0bf6363eb6e9d8
-
SSDEEP
6144:VDDsZ4F2idZecnl20lHRxp3gAYTQSPGcMfv6KtzgTSis83aLIB:1bF3Z4mxxKQHfvF1gT73UIB
Malware Config
Signatures
-
Gh0st RAT payload 3 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Drops file in Drivers directory 1 IoCs
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Drops file in System32 directory 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_499bee2e85e2509e1483ae2e8fd1fd25.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_499bee2e85e2509e1483ae2e8fd1fd25.exe"1⤵
- Server Software Component: Terminal Services DLL
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs -s FastUserSwitchingCompatibility1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
99KB
MD5766013bee06acacc49d64b24e05b64e9
SHA1b4b9d46c1edd08a8d5571276b75b9066131587af
SHA25606593e27ddea2c7ec6b8495287210c87ee58f12cf717d3912c00f17527b8ceaf
SHA512a74c5aae242fe7d5f60e948dfeef243177e11b722df2ab3e8dcf40cc7452651a404d95822560fe7d6fae23ad0b09b1cb8685957cd151c2a56982d236d8c09eaf
-
Filesize
99KB
MD5f916c04d4308a2c57678601f14c5e99b
SHA1ca45397019b7e4afd287a5bdb252a721e40ce055
SHA2563c0abc89572ccf75e9263dd704c64de08e241dcd3bb12541e4aa838aecdcea8b
SHA512778a276ec309ce56833258907e9811347861dd1875f6e3048686e8553130b1bbfc54f396d7d3e1764ce864c9da1723351db733e6372213947aafaf7b506c6aff
-
Filesize
496KB
-
Filesize
336KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
496KB
-
Filesize
336KB