gh0strat | JaffaCakes118_5c9b6da2a27e3e5e615952fb51f20adc

Sharing

Copy URL

Twitter E-mail

General

Target

JaffaCakes118_5c9b6da2a27e3e5e615952fb51f20adc
Size

148KB
MD5

5c9b6da2a27e3e5e615952fb51f20adc
SHA1

c095a66dc5478d9252bf40cfa383631cc957e175
SHA256

bf7837b00ecb0d8386bbe544144f741cb13bcb7d58177eea1df946e01fa50820
SHA512

c897f355f17646e67a4802205d0751587069e7cf5b7a1c5d44f90365d09fb31b21164b8b969101d7af0c727c36e3dafc8f0fd757b1b57c2df6c724c91552f2b5
SSDEEP

3072:K3Ue5ku6B6GnE8gONkvO4sHOKoTBftM/OuHPTl/o0:OUaku6BHpgXv/KoTBlM/OuHPF

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_5c9b6da2a27e3e5e615952fb51f20adc

Files

JaffaCakes118_5c9b6da2a27e3e5e615952fb51f20adc
.dll windows:4 windows x86 arch:x86

b9be3bb22e8865305ecd94522ddc693b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrlenA
lstrcatA
GetLocalTime
GlobalUnlock
GlobalLock
GlobalSize
HeapFree
GetProcessHeap
MapViewOfFile
GetLastError
CreateFileMappingA
GetShortPathNameA
lstrcpyA
HeapAlloc
LocalFree
LocalAlloc
Thread32Next
VirtualQuery
OpenThread
Thread32First
GetProcAddress
GetModuleHandleA
GetCurrentProcessId
GetCurrentThreadId
GetSystemDirectoryA
MultiByteToWideChar
lstrcmpiA
SetEnvironmentVariableA
GetTempPathA
GetLongPathNameA
GetModuleFileNameA
InterlockedExchange
Sleep
GlobalFree
GlobalAlloc
CloseHandle
FreeLibrary
lstrcmpA
GetPrivateProfileStringA
GetPrivateProfileSectionNamesA
GetVersionExA
ExpandEnvironmentStringsA
SuspendThread
ResumeThread
GetSystemInfo
GetProcessTimes
GetCurrentProcess
GlobalMemoryStatusEx
GetTempFileNameA
DeleteFileA
RemoveDirectoryA
ExitThread
FreeLibraryAndExitThread
IsBadReadPtr
IsBadStringPtrW
InitializeCriticalSection
LeaveCriticalSection
InterlockedDecrement
InterlockedIncrement
LocalSize
LocalReAlloc
ExitProcess
GetExitCodeProcess
SetUnhandledExceptionFilter
FormatMessageA
IsBadWritePtr
VirtualFree
VirtualAlloc
RaiseException
WideCharToMultiByte
GetTickCount
LoadLibraryA

user32

ShowWindow
FindWindowA
MessageBoxA
wvsprintfA
GetCursorInfo
DestroyCursor
LoadCursorA
CloseWindowStation
DestroyWindow
CreateWindowExA
wsprintfA
BlockInput

advapi32

RegOpenKeyExW

msvfw32

ICGetInfo

msvcrt

_adjust_fdiv
_initterm
_onexit
__dllonexit
??1type_info@@UAE@XZ
_strupr
_memicmp
_wcsicmp
_strlwr
ceil
memmove
__CxxFrameHandler
??3@YAXPAX@Z
??2@YAPAXI@Z
_except_handler3
strstr
rand
srand
_ftol
wcslen
strncpy
atoi
strchr
wcstombs
_CxxThrowException
free
malloc
wcsrchr
_beginthreadex
strrchr
strncat

Exports

Exports

TestProject

Sections

.text
Size: 96KB - Virtual size: 94KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b9be3bb22e8865305ecd94522ddc693b

Headers

File Characteristics

Imports

kernel32

user32

advapi32

msvfw32

msvcrt

Exports

Exports

Sections

.text Size: 96KB - Virtual size: 94KB

.rdata Size: 24KB - Virtual size: 20KB

.data Size: 12KB - Virtual size: 16KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 96KB - Virtual size: 94KB

.rdata
Size: 24KB - Virtual size: 20KB

.data
Size: 12KB - Virtual size: 16KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 8KB - Virtual size: 7KB