Overview

overview

10

Static

static

3

JaffaCakes...0c.exe

windows7-x64

10

JaffaCakes...0c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_481ca73b9c971aafc0d01fd55ce6400c

  • Size

    304KB

  • Sample

    250303-vrdn9attds

  • MD5

    481ca73b9c971aafc0d01fd55ce6400c

  • SHA1

    9d86a850c576d082a82c75620cce0bdeed470169

  • SHA256

    d6818b84aab8f4699b1ec9b09836806f47d58d42dacb2b81a7d57aa962c63de4

  • SHA512

    2d94ffc3d6eaa3cfc9c246c99ff2c370cb495ffc5f0237cab1cda1055aa3a78bf774a99212482c4157b0160e7b47fcb2938e28b6950ce7e970730e582d34438f

  • SSDEEP

    6144:i4f3OBkOFO8PRg2pqi+0rgoWUHSpW2qUzirTcxgTWZ4ka7+4J:i4feBJRrqi+w/H12BirTygJ3HJ

Score
10/10
gh0stratdefense_evasiondiscoverypersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_481ca73b9c971aafc0d01fd55ce6400c

    • Size

      304KB

    • MD5

      481ca73b9c971aafc0d01fd55ce6400c

    • SHA1

      9d86a850c576d082a82c75620cce0bdeed470169

    • SHA256

      d6818b84aab8f4699b1ec9b09836806f47d58d42dacb2b81a7d57aa962c63de4

    • SHA512

      2d94ffc3d6eaa3cfc9c246c99ff2c370cb495ffc5f0237cab1cda1055aa3a78bf774a99212482c4157b0160e7b47fcb2938e28b6950ce7e970730e582d34438f

    • SSDEEP

      6144:i4f3OBkOFO8PRg2pqi+0rgoWUHSpW2qUzirTcxgTWZ4ka7+4J:i4feBJRrqi+w/H12BirTygJ3HJ

    Score
    10/10
    gh0stratdefense_evasiondiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Indicator Removal: File Deletion

      Adversaries may delete files left behind by the actions of their intrusion activity.

      defense_evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks