Overview

overview

10

Static

static

10

JaffaCakes...0f.exe

windows7-x64

10

JaffaCakes...0f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_53a1669f529743bbae224d376355bb0f

  • Size

    308KB

  • Sample

    250305-zy2f4szjz9

  • MD5

    53a1669f529743bbae224d376355bb0f

  • SHA1

    480f764c3f90f925ccdf779c08402144f775aa3c

  • SHA256

    ee967f6b80ddb226f340899640484ccb32a73cacbd52248fff63c5dd6ef3595d

  • SHA512

    2d3f1df284d3b009069ccfed9d59e47cf9b143a220b9ec9954a8a131b60c6a80fd45e92ac913daf926cc241042e7d4c4766c77d02a4a199aa5256fc74d93885d

  • SSDEEP

    6144:MiTtiWB0wL7t/J5Gp34EnUC4G7v4G7AWF/:LXB0wd/rGN7UEJAi

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_53a1669f529743bbae224d376355bb0f

    • Size

      308KB

    • MD5

      53a1669f529743bbae224d376355bb0f

    • SHA1

      480f764c3f90f925ccdf779c08402144f775aa3c

    • SHA256

      ee967f6b80ddb226f340899640484ccb32a73cacbd52248fff63c5dd6ef3595d

    • SHA512

      2d3f1df284d3b009069ccfed9d59e47cf9b143a220b9ec9954a8a131b60c6a80fd45e92ac913daf926cc241042e7d4c4766c77d02a4a199aa5256fc74d93885d

    • SSDEEP

      6144:MiTtiWB0wL7t/J5Gp34EnUC4G7v4G7AWF/:LXB0wd/rGN7UEJAi

    Score
    10/10
    gh0stratdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks