Overview

overview

10

Static

static

10

JaffaCakes...28.exe

windows7-x64

10

JaffaCakes...28.exe

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_4fdb53c607d9a1940722b4c340d83228

  • Size

    607KB

  • Sample

    250305-br1z1avlz5

  • MD5

    4fdb53c607d9a1940722b4c340d83228

  • SHA1

    585ffe06b173698a7518c2204044ff8a473c54bf

  • SHA256

    cb6a62372c324df503bacbc8bcece488a977e95f65b972a482788504a46b09b3

  • SHA512

    299a299de7b306c4ecec74ae29cb1712cbb3ce1486e323154c5a8329fb866ab0e0a606e3b31d16816a8d2d30400307e9d0fa96e11096779e9189a2abcca6ef94

  • SSDEEP

    12288:34ddhJlAghv3r+TsPREfWZRJTUb5XfM5A78HANUTNC:oblAghv3r+TsPREuRlU9fM5AD

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_4fdb53c607d9a1940722b4c340d83228

    • Size

      607KB

    • MD5

      4fdb53c607d9a1940722b4c340d83228

    • SHA1

      585ffe06b173698a7518c2204044ff8a473c54bf

    • SHA256

      cb6a62372c324df503bacbc8bcece488a977e95f65b972a482788504a46b09b3

    • SHA512

      299a299de7b306c4ecec74ae29cb1712cbb3ce1486e323154c5a8329fb866ab0e0a606e3b31d16816a8d2d30400307e9d0fa96e11096779e9189a2abcca6ef94

    • SSDEEP

      12288:34ddhJlAghv3r+TsPREfWZRJTUb5XfM5A78HANUTNC:oblAghv3r+TsPREuRlU9fM5AD

    Score
    10/10
    gh0stratdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks