Overview

overview

10

Static

static

1

JaffaCakes...1f.exe

windows7-x64

10

JaffaCakes...1f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_4af952f909bdcd6e514df6996c63051f

  • Size

    197KB

  • Sample

    250304-ehrlrazmy6

  • MD5

    4af952f909bdcd6e514df6996c63051f

  • SHA1

    910a54f082d21b45962907778000b6d96e17beab

  • SHA256

    0ad3accd8c65ff08504b5a9f3375ba67bc72a1186008050a50cb157caefd682e

  • SHA512

    e93f1a462adf6046bcbce4c0832e0616ff1c72ef41078f392e51999f0c7ddae00ae8fbd3f0df66dd18a676dd9af65b866b20a0df1287096462194df67731b9dc

  • SSDEEP

    6144:Z6M96wgvRHCzOYtqlGyzcsX3KA0LQIQRdJ:si3gNCpOdn/uSJ

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_4af952f909bdcd6e514df6996c63051f

    • Size

      197KB

    • MD5

      4af952f909bdcd6e514df6996c63051f

    • SHA1

      910a54f082d21b45962907778000b6d96e17beab

    • SHA256

      0ad3accd8c65ff08504b5a9f3375ba67bc72a1186008050a50cb157caefd682e

    • SHA512

      e93f1a462adf6046bcbce4c0832e0616ff1c72ef41078f392e51999f0c7ddae00ae8fbd3f0df66dd18a676dd9af65b866b20a0df1287096462194df67731b9dc

    • SSDEEP

      6144:Z6M96wgvRHCzOYtqlGyzcsX3KA0LQIQRdJ:si3gNCpOdn/uSJ

    Score
    10/10
    gh0stratdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks