gh0strat | fd90ebe760f9abbdf17121328c14178e260b5d83f3ad240cb0805f0aac7860c0 | Triage

Submit
Reports

Overview

overview

Static

static

JaffaCakes...4a.exe

windows7-x64

JaffaCakes...4a.exe

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_54e3ce1e73f5b6373703d5c7aff0694a
Size

156KB
Sample

250306-epn47sxwht
MD5

54e3ce1e73f5b6373703d5c7aff0694a
SHA1

a793839ae968790073dc5e46aa43daac7eee9dfb
SHA256

fd90ebe760f9abbdf17121328c14178e260b5d83f3ad240cb0805f0aac7860c0
SHA512

2c3b68bb46aa607eed354c05644f778a1dae1e70270005e4fc57aab70be766f46021430b1890f787663ed33c7f8da65034fd918db1d82fe75086417e433cffd4
SSDEEP

3072:uo0IpeXWit3BHgqVibRj1U9doMigzLe1a7Lt17haeRriuemHC1a:u1weGEWkibRG9dPigz60F11Vriuex1a

Score

10^/10

gh0strat discovery persistence rat

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_54e3ce1e73f5b6373703d5c7aff0694a.exe

Resource

win7-20240903-en

gh0strat discovery persistence rat

windows7-x64

8 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_54e3ce1e73f5b6373703d5c7aff0694a.exe

Resource

win10v2004-20250217-en

gh0strat discovery persistence rat

windows10-2004-x64

8 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_54e3ce1e73f5b6373703d5c7aff0694a
- Size
  
  156KB
- MD5
  
  54e3ce1e73f5b6373703d5c7aff0694a
- SHA1
  
  a793839ae968790073dc5e46aa43daac7eee9dfb
- SHA256
  
  fd90ebe760f9abbdf17121328c14178e260b5d83f3ad240cb0805f0aac7860c0
- SHA512
  
  2c3b68bb46aa607eed354c05644f778a1dae1e70270005e4fc57aab70be766f46021430b1890f787663ed33c7f8da65034fd918db1d82fe75086417e433cffd4
- SSDEEP
  
  3072:uo0IpeXWit3BHgqVibRj1U9doMigzLe1a7Lt17haeRriuemHC1a:u1weGEWkibRG9dPigz60F11Vriuex1a
Score

10^/10

gh0strat discovery persistence rat
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0strat family
  gh0strat
- Server Software Component: Terminal Services DLL
  persistence
- Deletes itself
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Server Software Component

Terminal Services DLL

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gh0stratdiscoverypersistencerat

behavioral2

gh0stratdiscoverypersistencerat

© 2018-2025

Terms | Privacy