Overview

overview

10

Static

static

10

JaffaCakes...9a.exe

windows7-x64

10

JaffaCakes...9a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_4f9183f4f1ba51f1d663cb7b535fa09a

  • Size

    151KB

  • Sample

    250304-zqhn2azzcv

  • MD5

    4f9183f4f1ba51f1d663cb7b535fa09a

  • SHA1

    a41e777cf2a500849e694f4478ada4ce968e9b78

  • SHA256

    230f01614f0831bdb042ebb2fc328c778f4c4b0d3d43fca841e835add9601d78

  • SHA512

    0e9b8bbaafa398e30b5627972383f3260f4826dd279ca90af02ba79b250f7ad1697155af778c484568d82466a2d982f648411343a6bcd46863b9f3f54893bf0a

  • SSDEEP

    3072:TS3i7bVEnOr5UP6hKRXuS6S9L3e2ta2OMdj3Ksx9e8o+m:TSKVEnOr5UyhZK973aodj6s3m

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_4f9183f4f1ba51f1d663cb7b535fa09a

    • Size

      151KB

    • MD5

      4f9183f4f1ba51f1d663cb7b535fa09a

    • SHA1

      a41e777cf2a500849e694f4478ada4ce968e9b78

    • SHA256

      230f01614f0831bdb042ebb2fc328c778f4c4b0d3d43fca841e835add9601d78

    • SHA512

      0e9b8bbaafa398e30b5627972383f3260f4826dd279ca90af02ba79b250f7ad1697155af778c484568d82466a2d982f648411343a6bcd46863b9f3f54893bf0a

    • SSDEEP

      3072:TS3i7bVEnOr5UP6hKRXuS6S9L3e2ta2OMdj3Ksx9e8o+m:TSKVEnOr5UyhZK973aodj6s3m

    Score
    10/10
    gh0stratdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Server Software Component: Terminal Services DLL

      persistence

    • Deletes itself

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks