Overview

overview

10

Static

static

10

JaffaCakes...e9.exe

windows7-x64

10

JaffaCakes...e9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_4776985be04382486b7d621a68250ce9

  • Size

    122KB

  • Sample

    250303-rkxl1azvgw

  • MD5

    4776985be04382486b7d621a68250ce9

  • SHA1

    2c0731c08123e1f2c949b642b84cd0ce357e0c8a

  • SHA256

    799eca9940d40ba12157d302e46780a0d9d6425ae55ad6908add33256f4d039c

  • SHA512

    cd31489144d461123d6e2b59a4b2f1022877607232ee766c0ceb9ec4ba46eddd98a83f0f7b5e16a36c0cdbaebb0ce4d296c4e217981c8060a19503f17d58f608

  • SSDEEP

    3072:/HV49YZ8DqcLCL7Sw8PpQyULvMpCd/9wtUJ4uHcsF6Hm:/149i8DqkCXSw8KZBdlNJ4FsR

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_4776985be04382486b7d621a68250ce9

    • Size

      122KB

    • MD5

      4776985be04382486b7d621a68250ce9

    • SHA1

      2c0731c08123e1f2c949b642b84cd0ce357e0c8a

    • SHA256

      799eca9940d40ba12157d302e46780a0d9d6425ae55ad6908add33256f4d039c

    • SHA512

      cd31489144d461123d6e2b59a4b2f1022877607232ee766c0ceb9ec4ba46eddd98a83f0f7b5e16a36c0cdbaebb0ce4d296c4e217981c8060a19503f17d58f608

    • SSDEEP

      3072:/HV49YZ8DqcLCL7Sw8PpQyULvMpCd/9wtUJ4uHcsF6Hm:/149i8DqkCXSw8KZBdlNJ4FsR

    Score
    10/10
    gh0stratdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Server Software Component: Terminal Services DLL

      persistence

    • Deletes itself

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks