Overview

overview

10

Static

static

10

JaffaCakes...3d.exe

windows7-x64

10

JaffaCakes...3d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_5c5bc098117330e9713e137c231ded3d

  • Size

    488KB

  • Sample

    250310-bz1n7syjx6

  • MD5

    5c5bc098117330e9713e137c231ded3d

  • SHA1

    587309cd2b053465a1dfd9641218dab1f9e8b3d4

  • SHA256

    394f079055ec14e8a60130152f8d1c4b5c78d672d8137345d85e7f535b81145a

  • SHA512

    6d93865f553229d594898709f1a0e4edef045228e8591fff1b9d684ae48fa8b9aacbea811091704c6db691400fdac6329e42eb544d98981ea85a57496b48b0b2

  • SSDEEP

    12288:VM5jZKbBL3aKHx5r+TuxX+fWbwFBfdGmz:VM5j8Z3aKHx5r+TuxX+IwffFz

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_5c5bc098117330e9713e137c231ded3d

    • Size

      488KB

    • MD5

      5c5bc098117330e9713e137c231ded3d

    • SHA1

      587309cd2b053465a1dfd9641218dab1f9e8b3d4

    • SHA256

      394f079055ec14e8a60130152f8d1c4b5c78d672d8137345d85e7f535b81145a

    • SHA512

      6d93865f553229d594898709f1a0e4edef045228e8591fff1b9d684ae48fa8b9aacbea811091704c6db691400fdac6329e42eb544d98981ea85a57496b48b0b2

    • SSDEEP

      12288:VM5jZKbBL3aKHx5r+TuxX+fWbwFBfdGmz:VM5j8Z3aKHx5r+TuxX+IwffFz

    Score
    10/10
    gh0stratdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks