gh0strat | JaffaCakes118_4bb9898e2d50718a55d91b488a065dc0

Sharing

Copy URL

Twitter E-mail

General

Target

JaffaCakes118_4bb9898e2d50718a55d91b488a065dc0
Size

630KB
MD5

4bb9898e2d50718a55d91b488a065dc0
SHA1

8740f152c4f74a935cf8d3d29b628029dbe62877
SHA256

ba15d9c8f04c38a3e8355e871c3908d8943d1f307b40a42d1aff5e70ffcf3584
SHA512

95586db96629f2f4d64d69f29923fc6e9688cb6fab6f393bb1459dc6ddb0c84e3048a2667a29ee30969d25d2bfa80e78e41b486fefc244475e2c6896c7f01c42
SSDEEP

12288:21M53Wti/XneXRmzlUcBjDr+TybNUlWTkTW+b5YJfdJbJag:21M53Wti5lUcBjDr+TybNU2kq+WFdZcg

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_4bb9898e2d50718a55d91b488a065dc0

Files

JaffaCakes118_4bb9898e2d50718a55d91b488a065dc0
.exe windows:4 windows x86 arch:x86

91f8d884714e0d47c6e9cfc5df8fd272

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

avicap32

capGetDriverDescriptionA

kernel32

GlobalMemoryStatus
GetTickCount
GlobalLock
GetCurrentProcess
GetStartupInfoA
OpenProcess
GetPriorityClass
GetCurrentThread
GetThreadPriority
SetPriorityClass
SetThreadPriority
QueryPerformanceFrequency
QueryPerformanceCounter
GetModuleFileNameA
GlobalAlloc
GlobalUnlock
HeapAlloc
HeapFree
MultiByteToWideChar
Sleep
DeviceIoControl
GetVersion
MoveFileA
LocalAlloc
FindFirstFileA
FindClose
GetLogicalDriveStringsA
GetVolumeInformationA
GetDriveTypeA
GetFileAttributesA
CreateDirectoryA
GetPrivateProfileStringA
lstrcmpA
FreeLibrary
GetWindowsDirectoryA
lstrcatA
GetPrivateProfileSectionNamesA
lstrlenA
InterlockedExchange
lstrcpyA
ResetEvent
WideCharToMultiByte
LeaveCriticalSection
LoadLibraryA
GetProcAddress
GetSystemInfo
LCMapStringW
LCMapStringA
SetFilePointer
FlushFileBuffers
SetStdHandle
GetOEMCP
GetACP
GetCPInfo
GetStringTypeW
GetStringTypeA
InterlockedIncrement
InterlockedDecrement
IsBadCodePtr
IsBadReadPtr
SetUnhandledExceptionFilter
CloseHandle
WriteFile
GetFileType
GetStdHandle
SetHandleCount
GetEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsW
RtlUnwind
ExitProcess
TerminateProcess
GetLastError
CreateThread
GetCurrentThreadId
TlsSetValue
TlsGetValue
ExitThread
GetModuleHandleA
GetCommandLineA
TlsAlloc
SetLastError
RaiseException
GetEnvironmentVariableA
GetVersionExA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
IsBadWritePtr
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
HeapSize
UnhandledExceptionFilter
FreeEnvironmentStringsA

gdi32

GetDIBits
BitBlt
DeleteDC
DeleteObject
CreateCompatibleDC
CreateDIBSection
SelectObject
CreateCompatibleBitmap

advapi32

LookupAccountNameA
LsaClose
RegCreateKeyExA
RegSetValueExA
RegDeleteKeyA
RegDeleteValueA
RegQueryValueExA
RegEnumKeyExA
RegEnumValueA
OpenProcessToken
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenEventLogA
ClearEventLogA
CloseEventLog
RegOpenKeyExA
RegQueryValueA
RegCloseKey
LsaFreeMemory
LsaOpenPolicy
LsaRetrievePrivateData
IsValidSid

shell32

SHGetSpecialFolderPathA
SHGetFileInfoA

ole32

CoUninitialize
CoInitialize
CoTaskMemFree
CoCreateInstance

oleaut32

SysFreeString

winmm

waveOutGetNumDevs
waveOutOpen
waveOutPrepareHeader
waveInGetNumDevs
waveInOpen
waveInPrepareHeader
waveInAddBuffer
waveOutClose
waveOutWrite
waveInStop
waveInReset
waveInUnprepareHeader
waveInClose
waveOutReset
waveOutUnprepareHeader
waveInStart

urlmon

URLDownloadToFileA

netapi32

NetUserAdd
NetLocalGroupAddMembers

psapi

EnumProcessModules
GetModuleFileNameExA

wtsapi32

WTSQuerySessionInformationA
WTSFreeMemory

Sections

.text
Size: 498KB - Virtual size: 498KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 23KB - Virtual size: 491KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 107KB - Virtual size: 106KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

91f8d884714e0d47c6e9cfc5df8fd272

Headers

File Characteristics

Imports

avicap32

kernel32

gdi32

advapi32

shell32

ole32

oleaut32

winmm

urlmon

netapi32

psapi

wtsapi32

Sections

.text Size: 498KB - Virtual size: 498KB

.data Size: 23KB - Virtual size: 491KB

.rsrc Size: 107KB - Virtual size: 106KB

.text
Size: 498KB - Virtual size: 498KB

.data
Size: 23KB - Virtual size: 491KB

.rsrc
Size: 107KB - Virtual size: 106KB