Overview

overview

10

Static

static

3

JaffaCakes...e1.exe

windows7-x64

10

JaffaCakes...e1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_53616e5fe88226e86b5aecdc9299f2e1

  • Size

    188KB

  • Sample

    250305-yjbrgaxpv7

  • MD5

    53616e5fe88226e86b5aecdc9299f2e1

  • SHA1

    a0c1794dc9f497a8d30c8ad64580bd334f670de1

  • SHA256

    e35d2512c32019682a0fcc223e5139ca52ff4d8cca184b8235b1fc4fadb760f4

  • SHA512

    5c244ecc8bc45f4d7f5223d2a8668fd0d25d3efe023681d9a255b6cee5090e729d33553c6e27010c24adf46e3648c8eb36700b0290a0ae4bfd8f2e24afc0955e

  • SSDEEP

    3072:raQ6DgnWX0kdL49APvyfeGynB4YhJ2fwvZavp3ZfuSus5qHsHTl0Fep+0NjP:pAgnWX0wP0cSEjvw5B0UkE

Score
10/10
gh0stratbootkitdiscoverypersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_53616e5fe88226e86b5aecdc9299f2e1

    • Size

      188KB

    • MD5

      53616e5fe88226e86b5aecdc9299f2e1

    • SHA1

      a0c1794dc9f497a8d30c8ad64580bd334f670de1

    • SHA256

      e35d2512c32019682a0fcc223e5139ca52ff4d8cca184b8235b1fc4fadb760f4

    • SHA512

      5c244ecc8bc45f4d7f5223d2a8668fd0d25d3efe023681d9a255b6cee5090e729d33553c6e27010c24adf46e3648c8eb36700b0290a0ae4bfd8f2e24afc0955e

    • SSDEEP

      3072:raQ6DgnWX0kdL49APvyfeGynB4YhJ2fwvZavp3ZfuSus5qHsHTl0Fep+0NjP:pAgnWX0wP0cSEjvw5B0UkE

    Score
    10/10
    gh0stratbootkitdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks