Overview

overview

10

Static

static

1

JaffaCakes...26.exe

windows7-x64

10

JaffaCakes...26.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_61ace1d528aee5c61a3b2843b83a8826

  • Size

    89KB

  • Sample

    250310-18tppazrv8

  • MD5

    61ace1d528aee5c61a3b2843b83a8826

  • SHA1

    b0b8200578113ed2f7f5ad4a1e0b0edb5140b3f7

  • SHA256

    44e00dd13b62e3b2d56a443823b55f81c339c3d16caaa89844616aebe1f2240c

  • SHA512

    ae6d35ee6d8a92a6f83639bc022ad7dc15edb526ee9d2f1bbf649521f5fb18ba08e53cc834c5932e2d0e72006e83e6314a46dda9b309b1d183c1d59d613931f7

  • SSDEEP

    1536:kvGoWIfXuSL+7rycoMzVsUqsi3XDOxUQq4+I87dVTAEEbb8yIacoYZ/N:GldfXuR7joMzVATnDOG4+1AR6VoYZ/N

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_61ace1d528aee5c61a3b2843b83a8826

    • Size

      89KB

    • MD5

      61ace1d528aee5c61a3b2843b83a8826

    • SHA1

      b0b8200578113ed2f7f5ad4a1e0b0edb5140b3f7

    • SHA256

      44e00dd13b62e3b2d56a443823b55f81c339c3d16caaa89844616aebe1f2240c

    • SHA512

      ae6d35ee6d8a92a6f83639bc022ad7dc15edb526ee9d2f1bbf649521f5fb18ba08e53cc834c5932e2d0e72006e83e6314a46dda9b309b1d183c1d59d613931f7

    • SSDEEP

      1536:kvGoWIfXuSL+7rycoMzVsUqsi3XDOxUQq4+I87dVTAEEbb8yIacoYZ/N:GldfXuR7joMzVATnDOG4+1AR6VoYZ/N

    Score
    10/10
    gh0stratdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks