Behavioral task
behavioral1
Sample
JaffaCakes118_486e58d40b4bdf2abbdceb6f59c1d37c.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
JaffaCakes118_486e58d40b4bdf2abbdceb6f59c1d37c.exe
Resource
win10v2004-20250217-en
General
-
Target
JaffaCakes118_486e58d40b4bdf2abbdceb6f59c1d37c
-
Size
146KB
-
MD5
486e58d40b4bdf2abbdceb6f59c1d37c
-
SHA1
ac9da00bf6fd2918ddec303dc601a78048835fc4
-
SHA256
1bbae3f8902799dcf08e8cfc3f2e414fa15a28150cf7b64135d25db678845c1f
-
SHA512
aa90078e06efacf40a6dd82c66091617738e2ff99c27ab260f38abb0f25992a52cfed0770cb153b83fb0d9f3e1948487693e46a4c13bfc502cd0fc88cb195ea1
-
SSDEEP
3072:QhPyIdvcRrUWyQY0qbicrELkJjKyjffEV6rfPjc:IPyI5cru9iyAkJOCw3
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_486e58d40b4bdf2abbdceb6f59c1d37c
Files
-
JaffaCakes118_486e58d40b4bdf2abbdceb6f59c1d37c.exe windows:4 windows x86 arch:x86
75d61307d958a16545fea1a5115eac98
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Imports
advapi32
AdjustTokenPrivileges
LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegDeleteValueA
RegDeleteKeyA
RegSetValueExA
RegOpenKeyExA
RegCreateKeyExA
CloseServiceHandle
StartServiceA
OpenServiceA
OpenSCManagerA
CreateServiceA
RegQueryValueExA
user32
wsprintfA
msvcrt
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__getmainargs
_acmdln
exit
_XcptFilter
_exit
strstr
strchr
??2@YAPAXI@Z
??3@YAXPAX@Z
_except_handler3
malloc
realloc
_controlfp
kernel32
GetStartupInfoA
SetLastError
lstrcpyA
GetTempPathA
GetTickCount
MoveFileA
SetFileAttributesA
DeleteFileA
GetCommandLineA
CreateMutexA
GetLastError
ReleaseMutex
Sleep
GetWindowsDirectoryA
lstrcatA
GetFileAttributesA
CreateDirectoryA
WinExec
lstrlenA
ExitProcess
GetModuleHandleA
FindResourceA
LoadResource
CloseHandle
GetCurrentProcess
ReadFile
SetFilePointer
CreateFileA
GetModuleFileNameA
FreeResource
WriteFile
SizeofResource
SetFileTime
LocalFileTimeToFileTime
SystemTimeToFileTime
Sections
.text Size: 7KB - Virtual size: 6KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 138KB - Virtual size: 137KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ