Overview

overview

10

Static

static

10

JaffaCakes...4e.exe

windows7-x64

10

JaffaCakes...4e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_54b296adf6d73b04120e1926eb4c204e

  • Size

    172KB

  • Sample

    250306-djrgpsxky3

  • MD5

    54b296adf6d73b04120e1926eb4c204e

  • SHA1

    fab27ec1340df44db93802dcb63ea76b59c41361

  • SHA256

    742b089daa07e50d958bce3a45ca3244f30315276ae662c1dc84aece0d098f17

  • SHA512

    44c79954082f2c5c926479717f170b824d780e788dbb6419c4c37816522d5f5ba007b4916264e22d3c3bda2deb02eb272bb2275d380df2029c1322092913d448

  • SSDEEP

    3072:DiFteIZP9993rganIsWlDNiSuEgzhqr2NBG:SL9VrfCNFhgzhqr2vG

Score
10/10
gh0stratdiscoveryrat

Malware Config

Targets

    • Target

      JaffaCakes118_54b296adf6d73b04120e1926eb4c204e

    • Size

      172KB

    • MD5

      54b296adf6d73b04120e1926eb4c204e

    • SHA1

      fab27ec1340df44db93802dcb63ea76b59c41361

    • SHA256

      742b089daa07e50d958bce3a45ca3244f30315276ae662c1dc84aece0d098f17

    • SHA512

      44c79954082f2c5c926479717f170b824d780e788dbb6419c4c37816522d5f5ba007b4916264e22d3c3bda2deb02eb272bb2275d380df2029c1322092913d448

    • SSDEEP

      3072:DiFteIZP9993rganIsWlDNiSuEgzhqr2NBG:SL9VrfCNFhgzhqr2vG

    Score
    10/10
    gh0stratdiscoveryrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks