Overview

overview

10

Static

static

3

JaffaCakes...77.exe

windows7-x64

10

JaffaCakes...77.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_5ae975e2cabf893cb93eb59265636077

  • Size

    192KB

  • Sample

    250309-ydntvayrt4

  • MD5

    5ae975e2cabf893cb93eb59265636077

  • SHA1

    1f32f75bb3a88e8af88087b0949f8e13b7f21cd2

  • SHA256

    62d0df06a3d3bde1494f312ea7b13894b6cbc809ac57e54cc8bec19973e2812e

  • SHA512

    f90ea988f6fbfd9ecba1ac49fcbef847829002db38726251fd0848d10f00baa579d440aa53f4d824bbc3aef31570c010e8b70b2970b58fa234f3e6ae350250c7

  • SSDEEP

    3072:4UvjUaIc/Jm9br3SIABZz1oXS1xTOy0tMhAW7YD1sQvvbVckFgzua4:4UYaIcs9iIxXE1Oy0+hAWUD1ssTVcsta

Score
10/10
gh0stratbootkitdiscoverypersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_5ae975e2cabf893cb93eb59265636077

    • Size

      192KB

    • MD5

      5ae975e2cabf893cb93eb59265636077

    • SHA1

      1f32f75bb3a88e8af88087b0949f8e13b7f21cd2

    • SHA256

      62d0df06a3d3bde1494f312ea7b13894b6cbc809ac57e54cc8bec19973e2812e

    • SHA512

      f90ea988f6fbfd9ecba1ac49fcbef847829002db38726251fd0848d10f00baa579d440aa53f4d824bbc3aef31570c010e8b70b2970b58fa234f3e6ae350250c7

    • SSDEEP

      3072:4UvjUaIc/Jm9br3SIABZz1oXS1xTOy0tMhAW7YD1sQvvbVckFgzua4:4UYaIcs9iIxXE1Oy0+hAWUD1ssTVcsta

    Score
    10/10
    gh0stratbootkitdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Server Software Component: Terminal Services DLL

      persistence

    • Sets service image path in registry

      persistence

    • Deletes itself

    • Loads dropped DLL

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks