gh0strat | JaffaCakes118_5648bbbdd32b63dc884dc54bb8e6aeaa

General

Target

JaffaCakes118_5648bbbdd32b63dc884dc54bb8e6aeaa
Size

65KB
MD5

5648bbbdd32b63dc884dc54bb8e6aeaa
SHA1

8c1cbd5f28778913875aeb3313ae92b6a0c73db1
SHA256

48d6838b62797e3d6578effb378dc7b4562ea0344c05a24795404857a4089fee
SHA512

c692a73e16ee37db6dbdddb43537834fb25e425685b0b62639e1646ea6b5b4572f54a2a133b0ffa8da05e3b030358e1a4d3949256ca4913078f94e6cba6e5e4b
SSDEEP

768:B3OpXfozNUL54qsvFfyELnUmW0W3bVs95+dYInJERLCYXPgOioMGcKtChAYWIy2:9Opw654qs91UB3bVvdTY4ObcpWI

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_5648bbbdd32b63dc884dc54bb8e6aeaa

Files

JaffaCakes118_5648bbbdd32b63dc884dc54bb8e6aeaa
.exe windows:4 windows x86 arch:x86

4dcceb5bbe1bff269a3ffa40116133aa

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

ReadFile
SetFilePointer
GetModuleFileNameA
SetUnhandledExceptionFilter
Sleep
LoadLibraryA
CreateMutexA
GetCommandLineA
GetCurrentThreadId
FreeLibrary
GetFileAttributesA
SetLastError
lstrcmpiA
lstrcpyA
HeapFree
GetTempPathA
GetTickCount
FindResourceA
LoadResource
CreateFileA
SystemTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
SizeofResource
WriteFile
lstrlenA
CloseHandle
FreeResource
MoveFileA
SetFileAttributesA
DeleteFileA
GetSystemDirectoryA
MultiByteToWideChar
WideCharToMultiByte
ExitProcess
lstrcatA
GetLastError
GetProcessHeap
HeapAlloc
GetModuleHandleA
GetProcAddress
ReleaseMutex

user32

GetMessageA
PostThreadMessageA
GetInputState
wsprintfA

advapi32

SetFileSecurityA
GetUserNameA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyExA
RegSetValueExA
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
LookupAccountNameA
GetFileSecurityA
InitializeSecurityDescriptor
GetSecurityDescriptorDacl
GetAclInformation
GetLengthSid
InitializeAcl
GetAce
EqualSid
AddAce
AddAccessAllowedAce
SetSecurityDescriptorDacl
GetSecurityDescriptorControl
CreateServiceA
OpenSCManagerA
StartServiceA
OpenServiceA
CloseServiceHandle

netapi32

NetUserGetLocalGroups
NetApiBufferFree

msvcrt

malloc
??1type_info@@UAE@XZ
strstr
??3@YAXPAX@Z
_CxxThrowException
__CxxFrameHandler
??2@YAPAXI@Z
_except_handler3
realloc
strchr

Sections

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4dcceb5bbe1bff269a3ffa40116133aa

Headers

File Characteristics

Imports

kernel32

user32

advapi32

netapi32

msvcrt

Sections

.data Size: 8KB - Virtual size: 8KB

.rsrc Size: 85KB - Virtual size: 85KB

.data
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 85KB - Virtual size: 85KB