Behavioral task
behavioral1
Sample
JaffaCakes118_5345048a91a841d072166d50bf3c5dcf.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_5345048a91a841d072166d50bf3c5dcf.exe
Resource
win10v2004-20250217-en
General
-
Target
JaffaCakes118_5345048a91a841d072166d50bf3c5dcf
-
Size
544KB
-
MD5
5345048a91a841d072166d50bf3c5dcf
-
SHA1
88cf6eb2c3614f46f9109341c6a770bc1d8f6737
-
SHA256
6f4df3cebdfc44034df366ae7901fbfbb2cf08fb74f2a8ed1a6c87b546717d83
-
SHA512
9194fee717bdb819a7db9d0bc57b7064d77a7c9125477c4218f5c9de9026dcca7b530a2ce95f59750841899e6eec9df0450485c3e87866caff15f1d34dc1373c
-
SSDEEP
6144:ciTti+B0bL7t4A5gp34BEF4G7v4G7AWFUHp4G7AWFkW7:bPB0bd4AgNikJATA8
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_5345048a91a841d072166d50bf3c5dcf
Files
-
JaffaCakes118_5345048a91a841d072166d50bf3c5dcf.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 136KB - Virtual size: 133KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 28KB - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 356KB - Virtual size: 355KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ