Overview

overview

10

Static

static

10

JaffaCakes...40.exe

windows7-x64

10

JaffaCakes...40.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_5e17a65109afe120a6866727e91bf340

  • Size

    122KB

  • Sample

    250310-kjxgaaypz7

  • MD5

    5e17a65109afe120a6866727e91bf340

  • SHA1

    7b1ec880a9a6c2408bf79d9f75d58b33b7191e44

  • SHA256

    890aa8484f14fe925b8420f246c4a0173d6403b521d472ad2a291311d664152f

  • SHA512

    49cb32965f2f437f57b0c82df3344215250596e1475944038525b57d55a14a2254e95ad76ab8e77b4e882fa9058723fd84c0fc4c86141adc13b1655c40b59cf2

  • SSDEEP

    3072:a/uh9zZ8DHjBnu4RSw0fi8eVO3pCp/9wdUJ45HbDYj6HI:aWh9V8DHtnu2Sw0ZUplZJ49Ux

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_5e17a65109afe120a6866727e91bf340

    • Size

      122KB

    • MD5

      5e17a65109afe120a6866727e91bf340

    • SHA1

      7b1ec880a9a6c2408bf79d9f75d58b33b7191e44

    • SHA256

      890aa8484f14fe925b8420f246c4a0173d6403b521d472ad2a291311d664152f

    • SHA512

      49cb32965f2f437f57b0c82df3344215250596e1475944038525b57d55a14a2254e95ad76ab8e77b4e882fa9058723fd84c0fc4c86141adc13b1655c40b59cf2

    • SSDEEP

      3072:a/uh9zZ8DHjBnu4RSw0fi8eVO3pCp/9wdUJ45HbDYj6HI:aWh9V8DHtnu2Sw0ZUplZJ49Ux

    Score
    10/10
    gh0stratdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Server Software Component: Terminal Services DLL

      persistence

    • Deletes itself

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks