Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
-
submitted
09/03/2025, 16:57
General
-
Target
JaffaCakes118_5a3db7cd213e38be159a591b01329112.exe
-
Size
121KB
-
MD5
5a3db7cd213e38be159a591b01329112
-
SHA1
19bf604ac3789efeaf006172d13b8047e243b733
-
SHA256
8851a9b8642322e1742b2be201b65afcc7c6b3399fee93f1b5a006f80d6f856e
-
SHA512
134213898f88337ce7e73160f1dfe2a957c1b6e4ba0391a093679811c14c4aa5873dc8852b628b0a09baf292cc008a0645ff4fa6ccdea36a20e68300c4240594
-
SSDEEP
3072:gk2kuL6S/370oS5q9RYNlNFp6uk50cUtUNj:gkLS6S/rltROdpBHjtY
Malware Config
Signatures
-
Gh0st RAT payload 5 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
-
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
-
Deletes itself 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Drops file in Windows directory 3 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Kills process with taskkill 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5a3db7cd213e38be159a591b01329112.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5a3db7cd213e38be159a591b01329112.exe"1⤵
- Server Software Component: Terminal Services DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /t /im ZhuDongFangYu.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Deletes itself
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
366B
MD563c74b2ea23a5da046d46700b55809a0
SHA1da5c1d11dd9182ab1a3acefa4b8ead945e73d343
SHA25696546bb52bdf3df9e8bc5458748e5cd6b35bd1d0469912600f5a3b168a366e2f
SHA512de473b44d37e39efcbd36fa712e912c9a052e22ec3f933e71e3aaf74c40fe1ce204d0f19faa31b737cd03dc8376b17e6d47a8499c070a3ae88a39a6ba841df79
-
Filesize
106KB
MD5b265e35cc4ae9c6e25116f796462a881
SHA17308dd0416e947a98f6e595f54c39582ce980ba4
SHA25601657ef0cab2718584babd7e584d4680e051feb708167167b71e5321297667fc
SHA51239e56332a3f6161ede407c40b42c03beea96319e38f941407f845634d673b81ecfeea20d08fa16fe3f834fdcd00c5e11b83d8f42fcf5b0dfca324192294894bc
-
Filesize
136KB
-
Filesize
136KB
-
Filesize
140KB
-
Filesize
140KB