Behavioral task
behavioral1
Sample
JaffaCakes118_5965dd1f909c5fc2cb017eccd8aa166a.exe
Resource
win7-20240903-en
General
-
Target
JaffaCakes118_5965dd1f909c5fc2cb017eccd8aa166a
-
Size
107KB
-
MD5
5965dd1f909c5fc2cb017eccd8aa166a
-
SHA1
8ebee9dff2f3b5ff61dd6cd2e873748730d58ed2
-
SHA256
26f8edc65b69b69b8f5afa1f793f42ca49476e97ef270c67ddbfbd561b6fbed2
-
SHA512
2bd4c9d64f628e63f17cd3c9628352d2b46d6c8a6f228b022a7eafb83680e4f00456459cd6b81226860852e545d1e861cb5e71aa37f83e70786d7dfc8f72ebd3
-
SSDEEP
3072:i2c41xEBsY0GjoP/q8+p3cFIDwtLcdqNA/fCWkUbtID:MwxEBs3GjE/qiF1LkEcfClUbw
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
resource yara_rule sample family_gh0strat -
Gh0strat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource JaffaCakes118_5965dd1f909c5fc2cb017eccd8aa166a
Files
-
JaffaCakes118_5965dd1f909c5fc2cb017eccd8aa166a.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 9KB - Virtual size: 9KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 97KB - Virtual size: 100KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ