Overview

overview

10

Static

static

7

JaffaCakes...d8.exe

windows7-x64

10

JaffaCakes...d8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_4cc33d62e9f3dc5f6e742e10df5d5bd8

  • Size

    112KB

  • Sample

    250304-mdtvbaxzey

  • MD5

    4cc33d62e9f3dc5f6e742e10df5d5bd8

  • SHA1

    dfd96293ed116567979f17b83f05dda7dbbc8e35

  • SHA256

    14670d3fcfd36cc87ba01447111e140d8fe30d6ce981682457c9febe56e10683

  • SHA512

    d6a6d0e4b565189db9b03b34c87bf15290dec72b2f9edae20efe1a1638ef1eaaa38121cd2da29f6091d1f43e66552277af268ef63f82104432c3251c7ce61ac1

  • SSDEEP

    3072:117xkgco223QbrJTxNaovxSJ3ovrPWSEjb3iBT1:117qg52BFTroJKrPSjb3iBT1

Score
10/10
gh0stratdiscoverypersistenceratvmprotect

Malware Config

Targets

    • Target

      JaffaCakes118_4cc33d62e9f3dc5f6e742e10df5d5bd8

    • Size

      112KB

    • MD5

      4cc33d62e9f3dc5f6e742e10df5d5bd8

    • SHA1

      dfd96293ed116567979f17b83f05dda7dbbc8e35

    • SHA256

      14670d3fcfd36cc87ba01447111e140d8fe30d6ce981682457c9febe56e10683

    • SHA512

      d6a6d0e4b565189db9b03b34c87bf15290dec72b2f9edae20efe1a1638ef1eaaa38121cd2da29f6091d1f43e66552277af268ef63f82104432c3251c7ce61ac1

    • SSDEEP

      3072:117xkgco223QbrJTxNaovxSJ3ovrPWSEjb3iBT1:117qg52BFTroJKrPSjb3iBT1

    Score
    10/10
    gh0stratdiscoverypersistenceratvmprotect

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Server Software Component: Terminal Services DLL

      persistence

    • Loads dropped DLL

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks