gh0strat | 2a1034dd32bf7a79fa810ac42fe1c27ace6955bdb21b2f12db0322880ac39c18 | Triage

Submit
Reports

Overview

overview

Static

static

JaffaCakes...e4.exe

windows7-x64

JaffaCakes...e4.exe

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_592420158f89efbb28d0bdb904c19de4
Size

70KB
Sample

250308-p7r9paxnw7
MD5

592420158f89efbb28d0bdb904c19de4
SHA1

d068f6d7fab9cb50240cbe1512bf996e2dfc1001
SHA256

2a1034dd32bf7a79fa810ac42fe1c27ace6955bdb21b2f12db0322880ac39c18
SHA512

27b07297efa856eb3fd50853295fe104e9b73520d6a91742ecd57d42fda2385b6ab7837ba6fd2955f41b922456832ef1bbf890b6bf90b858979596a1e58dc3be
SSDEEP

768:YqpmE7/ab4ZzVFT5W2LbMGc6dLhFoYlUEfXA6/nZkxHvHc1kv/n6Ur8xPFpzUfo:mef5W2BcqoWfXA6PZCv81k8zUA

Score

10^/10

gh0strat discovery persistence rat

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_592420158f89efbb28d0bdb904c19de4.exe

Resource

win7-20250207-en

gh0strat discovery persistence rat

windows7-x64

13 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_592420158f89efbb28d0bdb904c19de4.exe

Resource

win10v2004-20250217-en

gh0strat discovery persistence rat

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_592420158f89efbb28d0bdb904c19de4
- Size
  
  70KB
- MD5
  
  592420158f89efbb28d0bdb904c19de4
- SHA1
  
  d068f6d7fab9cb50240cbe1512bf996e2dfc1001
- SHA256
  
  2a1034dd32bf7a79fa810ac42fe1c27ace6955bdb21b2f12db0322880ac39c18
- SHA512
  
  27b07297efa856eb3fd50853295fe104e9b73520d6a91742ecd57d42fda2385b6ab7837ba6fd2955f41b922456832ef1bbf890b6bf90b858979596a1e58dc3be
- SSDEEP
  
  768:YqpmE7/ab4ZzVFT5W2LbMGc6dLhFoYlUEfXA6/nZkxHvHc1kv/n6Ur8xPFpzUfo:mef5W2BcqoWfXA6PZCv81k8zUA
Score

10^/10

gh0strat discovery persistence rat
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0strat family
  gh0strat
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gh0stratdiscoverypersistencerat

behavioral2

gh0stratdiscoverypersistencerat

© 2018-2025

Terms | Privacy