gh0strat | 2a69b3eb2f254e0bbe89787d81e5e874aa49af33b33355e4efde5f9f214b8cb4 | Triage

Submit
Reports

Overview

overview

Static

static

7

JaffaCakes...b4.dll

windows7-x64

JaffaCakes...b4.dll

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_4eec95ddd3a200d5267ad5d268b9b0b4
Size

93KB
Sample

250304-wx4nasxsbt
MD5

4eec95ddd3a200d5267ad5d268b9b0b4
SHA1

433e7deb163d69d9de2495efc26403bfb0b87800
SHA256

2a69b3eb2f254e0bbe89787d81e5e874aa49af33b33355e4efde5f9f214b8cb4
SHA512

8c13360aeba70ee50bf7388bf18aa63bc291f4d8a86e9d6b3ea70f58ccfe78abcb00d2691a8c42e4438c4d64b19401a8209db7269ff99c52875af88b8dd69951
SSDEEP

1536:ANx1NpOvjkUa61qABhrYdlcgsXRzXkFXtJx8PlHXpra9+sJiZixMexk1JKjpHTN0:ANx1ukPEXr/1tXkFdJiPlHZO9+v2hxNF

Score

10^/10

gh0strat discovery rat vmprotect

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_4eec95ddd3a200d5267ad5d268b9b0b4.dll

Resource

win7-20241023-en

gh0strat discovery rat vmprotect

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_4eec95ddd3a200d5267ad5d268b9b0b4.dll

Resource

win10v2004-20250217-en

gh0strat discovery rat vmprotect

windows10-2004-x64

6 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_4eec95ddd3a200d5267ad5d268b9b0b4
- Size
  
  93KB
- MD5
  
  4eec95ddd3a200d5267ad5d268b9b0b4
- SHA1
  
  433e7deb163d69d9de2495efc26403bfb0b87800
- SHA256
  
  2a69b3eb2f254e0bbe89787d81e5e874aa49af33b33355e4efde5f9f214b8cb4
- SHA512
  
  8c13360aeba70ee50bf7388bf18aa63bc291f4d8a86e9d6b3ea70f58ccfe78abcb00d2691a8c42e4438c4d64b19401a8209db7269ff99c52875af88b8dd69951
- SSDEEP
  
  1536:ANx1NpOvjkUa61qABhrYdlcgsXRzXkFXtJx8PlHXpra9+sJiZixMexk1JKjpHTN0:ANx1ukPEXr/1tXkFdJiPlHZO9+v2hxNF
Score

10^/10

gh0strat discovery rat vmprotect
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0strat family
  gh0strat
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gh0stratdiscoveryratvmprotect

behavioral2

gh0stratdiscoveryratvmprotect

© 2018-2025

Terms | Privacy