gh0strat | 26423ae1b365a2d1c3023c6d6c424d6a8c835efb482efb0604748f392fe32a76 | Triage

Submit
Reports

Overview

overview

Static

static

JaffaCakes...22.exe

windows7-x64

JaffaCakes...22.exe

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_550003104fb869eab07cb4f401444322
Size

112KB
Sample

250306-fdhzgsyvfz
MD5

550003104fb869eab07cb4f401444322
SHA1

34ecb1051ebe2de91ad3c151990986d1da4ee798
SHA256

26423ae1b365a2d1c3023c6d6c424d6a8c835efb482efb0604748f392fe32a76
SHA512

42a4109f215710c490df44b9deaf268e3364d026111d0f98b5f33e0040a10a4504244f4390c8fcbb335b4999d462a75084bd779ba1c87aebe234117aa7c60c52
SSDEEP

1536:09406kxKhHWLy8cNSuEcIItf1bknPMye63Z7m7TckA2Z+j:mqkxq4fcNSuEPIV1bknkyeJfckA2Z+j

Score

10^/10

gh0strat discovery persistence rat

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_550003104fb869eab07cb4f401444322.exe

Resource

win7-20240729-en

gh0strat discovery persistence rat

windows7-x64

11 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_550003104fb869eab07cb4f401444322.exe

Resource

win10v2004-20250217-en

gh0strat discovery persistence rat

windows10-2004-x64

11 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_550003104fb869eab07cb4f401444322
- Size
  
  112KB
- MD5
  
  550003104fb869eab07cb4f401444322
- SHA1
  
  34ecb1051ebe2de91ad3c151990986d1da4ee798
- SHA256
  
  26423ae1b365a2d1c3023c6d6c424d6a8c835efb482efb0604748f392fe32a76
- SHA512
  
  42a4109f215710c490df44b9deaf268e3364d026111d0f98b5f33e0040a10a4504244f4390c8fcbb335b4999d462a75084bd779ba1c87aebe234117aa7c60c52
- SSDEEP
  
  1536:09406kxKhHWLy8cNSuEcIItf1bknPMye63Z7m7TckA2Z+j:mqkxq4fcNSuEPIV1bknkyeJfckA2Z+j
Score

10^/10

gh0strat discovery persistence rat
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0strat family
  gh0strat
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gh0stratdiscoverypersistencerat

behavioral2

gh0stratdiscoverypersistencerat

© 2018-2025

Terms | Privacy