gh0strat | cdadd77531f0b9b622b735b4ed5d2a537d830c6ca88831c00b837211b93237b1 | Triage

Submit
Reports

Overview

overview

Static

static

7

JaffaCakes...86.exe

windows7-x64

JaffaCakes...86.exe

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_537e5a06f5d59042f0d9d4e13fdebe86
Size

476KB
Sample

250305-y72mssyly9
MD5

537e5a06f5d59042f0d9d4e13fdebe86
SHA1

60667dc09dc7b07fd9905e57264ac777f5d95c73
SHA256

cdadd77531f0b9b622b735b4ed5d2a537d830c6ca88831c00b837211b93237b1
SHA512

a642794f8ad940b7375fcc663915b4f596ad42a2331af7911ef2b03a78e915d2b6d267b429e6541832e4beb7a08eef5e3198f32f8e13d4492150cf445dcb8f7c
SSDEEP

12288:uUt2h2gkmERjrOZVMUom9E2ZErDlAehRV8+QLxKoVyl:tt2h2gkRRjrmzD4ZAeh0+wpyl

Score

10^/10

gh0strat discovery rat vmprotect

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_537e5a06f5d59042f0d9d4e13fdebe86.exe

Resource

win7-20240903-en

gh0strat discovery rat vmprotect

windows7-x64

6 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_537e5a06f5d59042f0d9d4e13fdebe86.exe

Resource

win10v2004-20250217-en

gh0strat discovery rat vmprotect

windows10-2004-x64

6 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_537e5a06f5d59042f0d9d4e13fdebe86
- Size
  
  476KB
- MD5
  
  537e5a06f5d59042f0d9d4e13fdebe86
- SHA1
  
  60667dc09dc7b07fd9905e57264ac777f5d95c73
- SHA256
  
  cdadd77531f0b9b622b735b4ed5d2a537d830c6ca88831c00b837211b93237b1
- SHA512
  
  a642794f8ad940b7375fcc663915b4f596ad42a2331af7911ef2b03a78e915d2b6d267b429e6541832e4beb7a08eef5e3198f32f8e13d4492150cf445dcb8f7c
- SSDEEP
  
  12288:uUt2h2gkmERjrOZVMUom9E2ZErDlAehRV8+QLxKoVyl:tt2h2gkRRjrmzD4ZAeh0+wpyl
Score

10^/10

gh0strat discovery rat vmprotect
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0strat family
  gh0strat
- VMProtect packed file
  Detects executables packed with VMProtect commercial packer.
  vmprotect
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gh0stratdiscoveryratvmprotect

behavioral2

gh0stratdiscoveryratvmprotect

© 2018-2025

Terms | Privacy