Overview

overview

10

Static

static

10

JaffaCakes...19.exe

windows7-x64

10

JaffaCakes...19.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_5703a7d954b2028693ce896b36d63519

  • Size

    182KB

  • Sample

    250306-t2ll6ssyax

  • MD5

    5703a7d954b2028693ce896b36d63519

  • SHA1

    130e11903c10ffcc92e84e83c11e3093977887ea

  • SHA256

    a583d8a859b49ae5b3971e214a489ca7615484f7d48f47bffd322843e35b691d

  • SHA512

    48b55a1f636d3962c89a8b7b6be5cf6b3f59e1e6ffd71e7bf291d95b200a919ac1598d9980c29c0c602e44dab43c3ef37169472977e9f5f05ad5249530802dce

  • SSDEEP

    3072:TsfffQRzv8Rd6+6yGR6d6qZwVbFOnHlFVB4MkwaCpTw+6T3d9XsRzv8RLsL:IVr6yGQdteVobVST/CRw+S3dp6

Score
10/10
gh0stratdiscoveryrat

Malware Config

Targets

    • Target

      JaffaCakes118_5703a7d954b2028693ce896b36d63519

    • Size

      182KB

    • MD5

      5703a7d954b2028693ce896b36d63519

    • SHA1

      130e11903c10ffcc92e84e83c11e3093977887ea

    • SHA256

      a583d8a859b49ae5b3971e214a489ca7615484f7d48f47bffd322843e35b691d

    • SHA512

      48b55a1f636d3962c89a8b7b6be5cf6b3f59e1e6ffd71e7bf291d95b200a919ac1598d9980c29c0c602e44dab43c3ef37169472977e9f5f05ad5249530802dce

    • SSDEEP

      3072:TsfffQRzv8Rd6+6yGR6d6qZwVbFOnHlFVB4MkwaCpTw+6T3d9XsRzv8RLsL:IVr6yGQdteVobVST/CRw+S3dp6

    Score
    10/10
    gh0stratdiscoveryrat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks