Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
05/03/2025, 20:26
General
-
Target
JaffaCakes118_537e5a06f5d59042f0d9d4e13fdebe86.exe
-
Size
476KB
-
MD5
537e5a06f5d59042f0d9d4e13fdebe86
-
SHA1
60667dc09dc7b07fd9905e57264ac777f5d95c73
-
SHA256
cdadd77531f0b9b622b735b4ed5d2a537d830c6ca88831c00b837211b93237b1
-
SHA512
a642794f8ad940b7375fcc663915b4f596ad42a2331af7911ef2b03a78e915d2b6d267b429e6541832e4beb7a08eef5e3198f32f8e13d4492150cf445dcb8f7c
-
SSDEEP
12288:uUt2h2gkmERjrOZVMUom9E2ZErDlAehRV8+QLxKoVyl:tt2h2gkRRjrmzD4ZAeh0+wpyl
Score
10/10
Malware Config
Signatures
-
Gh0st RAT payload 2 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_537e5a06f5d59042f0d9d4e13fdebe86.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_537e5a06f5d59042f0d9d4e13fdebe86.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
1.1MB