Analysis
-
max time kernel
0s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
10/03/2025, 05:07
Errors
Reason
platform exec: image=C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5d389176cc3f280aa8859ee63dd4810e.exe
command="C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5d389176cc3f280aa8859ee63dd4810e.exe"
wdir=C:\Users\Admin\AppData\Local\Temp
Payload error: The application has failed to start because its side-by-side configuration is incorrect. Please see the application event log or use the command-line sxstrace.exe tool for more detail.
General
-
Target
JaffaCakes118_5d389176cc3f280aa8859ee63dd4810e.exe
-
Size
192KB
-
MD5
5d389176cc3f280aa8859ee63dd4810e
-
SHA1
db91d358df5e9999d80a79b5f8fbc2d79e8ef686
-
SHA256
f5a9f1b860462b5b2a03c81f466183c58eea70c16b0abd6eb6953112ae989ac6
-
SHA512
93d54fe912585bb8bde43c225fd7b80e03a919785fd82d9a498197c3f14c344a05f16ee483fde56ad128ea3822b3b7f90d9c27e8e3fd24e526d4ec86b245d682
-
SSDEEP
3072:uXDG5hiysR1jOI7FWUto4ug/eZkhiDZYC1CrM/AAy4Rm94W:uXbywjO0ZtNIkwOCKM49
Score
10/10
Malware Config
Signatures
-
Gh0st RAT payload 1 IoCs
-
Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
-
Gh0strat family
Processes
-
C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5d389176cc3f280aa8859ee63dd4810e.exe"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_5d389176cc3f280aa8859ee63dd4810e.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
204KB