gh0strat | 2eb17d1b539434f14964e8712967a316b60139342c03f1ab41cce26d525b6674 | Triage

Submit
Reports

Overview

overview

Static

static

JaffaCakes...d6.exe

windows7-x64

4

JaffaCakes...d6.exe

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_51971a2dfa78e538e44b44f04b0cd4d6
Size

159KB
Sample

250305-lzcbqavzgy
MD5

51971a2dfa78e538e44b44f04b0cd4d6
SHA1

fa02179f997e8ef3ce3515dc5056ed788b54e742
SHA256

2eb17d1b539434f14964e8712967a316b60139342c03f1ab41cce26d525b6674
SHA512

8c927c9a49629a8ffa93af19aefdd5e93e2711aa9fa7ec3e4335a5559b23d52068af5a5d65ed60732e8c6834f9b4a78af922a071e7df945af31c7028615a5a1c
SSDEEP

3072:RBymKRr0U5vw0TdLov8MDX8F9jywLatx2LbE4Uo7Nj:RBybjwyovIFtZLatw/E4U4

Score

10^/10

gh0strat discovery persistence rat

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_51971a2dfa78e538e44b44f04b0cd4d6.exe

Resource

win7-20250207-en

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_51971a2dfa78e538e44b44f04b0cd4d6.exe

Resource

win10v2004-20250217-en

gh0strat discovery persistence rat

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_51971a2dfa78e538e44b44f04b0cd4d6
- Size
  
  159KB
- MD5
  
  51971a2dfa78e538e44b44f04b0cd4d6
- SHA1
  
  fa02179f997e8ef3ce3515dc5056ed788b54e742
- SHA256
  
  2eb17d1b539434f14964e8712967a316b60139342c03f1ab41cce26d525b6674
- SHA512
  
  8c927c9a49629a8ffa93af19aefdd5e93e2711aa9fa7ec3e4335a5559b23d52068af5a5d65ed60732e8c6834f9b4a78af922a071e7df945af31c7028615a5a1c
- SSDEEP
  
  3072:RBymKRr0U5vw0TdLov8MDX8F9jywLatx2LbE4Uo7Nj:RBybjwyovIFtZLatw/E4U4
Score

10^/10

discovery gh0strat persistence rat
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0strat family
  gh0strat
- Server Software Component: Terminal Services DLL
  persistence
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

Terminal Services DLL

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

gh0stratdiscoverypersistencerat

© 2018-2025

Terms | Privacy