gh0strat | JaffaCakes118_4e65a90f28ff665b79714925e85b0b09 | Triage

Sharing

General

Target

JaffaCakes118_4e65a90f28ff665b79714925e85b0b09
Size

136KB
MD5

4e65a90f28ff665b79714925e85b0b09
SHA1

bd9edcfa5cdec34a7ff726e24975db10e8b4ca93
SHA256

3dd73498bd31896828bbacdc30e11d1c9600090362cda50e50509a72a7ce6224
SHA512

d0ea2be590be65a54fc101099537381969cc2d58bb8474d63d7be38641eaff0bbaffc13a60ced51bb3e1f625aa74acea1a83344bd7cadef933daec6595500645
SSDEEP

3072:uuWurg8qqVibRj1U9doMigzLe1a7Lt17haeRriuemHC1dH6:uuWurXqkibRG9dPigz60F11Vriuex1k

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_4e65a90f28ff665b79714925e85b0b09

Files

JaffaCakes118_4e65a90f28ff665b79714925e85b0b09
.exe windows:4 windows x86 arch:x86

99f5b0b723d6fca2813f516623081e1c

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

VirtualFree
VirtualAlloc
ExitProcess
GetProcAddress
LoadLibraryExA
GetModuleHandleA
VirtualProtect
GetModuleFileNameA
FreeLibrary
GetLastError
CreateMutexA
LoadLibraryA

user32

wsprintfA
MessageBoxA

Sections

.data
Size: - Virtual size: 152KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ex_cod
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 110KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ