Overview

overview

10

Static

static

1

JaffaCakes...ca.exe

windows7-x64

10

JaffaCakes...ca.exe

windows10-2004-x64

4

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_49d7c4b361a56ea50c7c2a4d2f35f7ca

  • Size

    193KB

  • Sample

    250303-3thpzstscy

  • MD5

    49d7c4b361a56ea50c7c2a4d2f35f7ca

  • SHA1

    f0a6d528861bf0af6ef0b0fb168407b172a955f9

  • SHA256

    d1958e61d9851e6dc2e684431594c973fd64ea865a5d70fac170c2d29209aa4e

  • SHA512

    9bd11239d630cc2eb463d9b0616f7ed84281c9535ffca9b96723fa3e4c33ef9ea9e66e5e4d44d328ad3eebf4c84e8a8b5e5f5c0841b70f03aae75c389fdf4d2f

  • SSDEEP

    6144:TGNnW4O+URStpqHH1KCfvlHn7iWlLSOyP4l191bUDXccpjaP:TGNWl+URStpqHH1KCfvlHnD9SOywl19R

Score
10/10
gh0stratbootkitdiscoverypersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_49d7c4b361a56ea50c7c2a4d2f35f7ca

    • Size

      193KB

    • MD5

      49d7c4b361a56ea50c7c2a4d2f35f7ca

    • SHA1

      f0a6d528861bf0af6ef0b0fb168407b172a955f9

    • SHA256

      d1958e61d9851e6dc2e684431594c973fd64ea865a5d70fac170c2d29209aa4e

    • SHA512

      9bd11239d630cc2eb463d9b0616f7ed84281c9535ffca9b96723fa3e4c33ef9ea9e66e5e4d44d328ad3eebf4c84e8a8b5e5f5c0841b70f03aae75c389fdf4d2f

    • SSDEEP

      6144:TGNnW4O+URStpqHH1KCfvlHn7iWlLSOyP4l191bUDXccpjaP:TGNWl+URStpqHH1KCfvlHnD9SOywl19R

    Score
    10/10
    gh0stratbootkitdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Deletes itself

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks