Behavioral task
behavioral1
Sample
JaffaCakes118_500fb7cd12114c56e9f03378715656cb.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_500fb7cd12114c56e9f03378715656cb
-
Size
97KB
-
MD5
500fb7cd12114c56e9f03378715656cb
-
SHA1
8215c5e3ced2acc6597467de9c10546d85a40fc9
-
SHA256
290aeb63fc04b67c25c3ba6f8b1c2fa959aa2b30073f92322986ebeaa6583b8b
-
SHA512
13ff694558e4d260f263b8e8110734dd3d43121f7fe0874d9c69e5a77e6260d77377a014990da1e746a2c7a2c2334dd3166642582a68307e3c590c75157683cc
-
SSDEEP
3072:OVESyGc1Vm6ok3I+ZM+hqhKIq368VYwTBy:OVESyGc1Vm6LYx+IxqKUfI
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_500fb7cd12114c56e9f03378715656cb
Files
-
JaffaCakes118_500fb7cd12114c56e9f03378715656cb.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 9KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 87KB - Virtual size: 88KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ