gh0strat | JaffaCakes118_607da1e97184907257cddecb39e0f140

Sharing

Copy URL

Twitter E-mail

General

Target

JaffaCakes118_607da1e97184907257cddecb39e0f140
Size

96KB
MD5

607da1e97184907257cddecb39e0f140
SHA1

9e8df3a77467c9c299fd7b348b99360d8dee41f2
SHA256

385a46eb248a25c78015d1df8a3a2015dfbb9859c576d87c4bca879d47f0aa80
SHA512

9875335a781e434ccf20fe78c1f99d10f64a10e903298b9b835e614617397f5795ff8e3fe6eb21a8465a5578e1f2264f7373d8f5e5bc7e2bd3b08d9f86e1200d
SSDEEP

1536:7aWLDmsKtc+aN3R00IgP26LnsAld4Wvt7DjKPRc6EQUf4+SDBccgyWQnHIuu5i77:mWHHA56v+6LLuctuPRsQG4+SSBNQnHIM

Score

10^/10

gh0strat

Malware Config

Signatures

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Gh0strat family
gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
JaffaCakes118_607da1e97184907257cddecb39e0f140

Files

JaffaCakes118_607da1e97184907257cddecb39e0f140
.dll windows:4 windows x86 arch:x86

12ef9c569459f5606cfe4e7ab7c49c0b

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetTickCount
GetLocalTime
GetCurrentProcessId
HeapAlloc
GetProcessHeap
DeleteFileA
CreateDirectoryA
GetFileAttributesA
lstrcpyA
lstrlenA
GetDriveTypeA
GetDiskFreeSpaceExA
GetVolumeInformationA
GetLogicalDriveStringsA
FindClose
LocalFree
FindNextFileA
LocalReAlloc
FindFirstFileA
LocalAlloc
RemoveDirectoryA
GetFileSize
CreateFileA
ReadFile
SetFilePointer
WriteFile
MoveFileA
lstrcatA
CancelIo
CreateProcessA
Process32Next
lstrcmpiA
Process32First
CreateToolhelp32Snapshot
HeapFree
MapViewOfFile
CreateFileMappingA
UnmapViewOfFile
GetModuleHandleA
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
GlobalSize
GetStartupInfoA
WaitForMultipleObjects
LocalSize
TerminateProcess
OpenProcess
GetCurrentThreadId
GlobalMemoryStatus
GetSystemInfo
GetComputerNameA
GetVersionExA
GetCurrentProcess
OpenEventA
SetErrorMode
InterlockedExchange
ResetEvent
GetLastError
VirtualAlloc
EnterCriticalSection
LeaveCriticalSection
VirtualFree
DeleteCriticalSection
CreateThread
ResumeThread
SetEvent
WaitForSingleObject
GetProcAddress
Sleep
TerminateThread
CloseHandle
FreeLibrary
LoadLibraryA
GetSystemDirectoryA
CreateEventA

user32

CloseWindow
IsWindow
PostMessageA
OpenDesktopA
GetThreadDesktop
GetUserObjectInformationA
OpenInputDesktop
SetThreadDesktop
CloseDesktop
IsWindowVisible
GetWindowThreadProcessId
ExitWindowsEx
GetCursorPos
GetCursorInfo
DestroyCursor
ReleaseDC
GetDesktopWindow
GetDC
GetSystemMetrics
GetClipboardData
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
mouse_event
SetCursorPos
WindowFromPoint
SetCapture
SetRect
DispatchMessageA
TranslateMessage
GetMessageA
CharNextA
wsprintfA
GetWindowTextA
MessageBoxA
LoadCursorA
BlockInput
SendMessageA
keybd_event
MapVirtualKeyA

advapi32

LookupPrivilegeValueA
OpenProcessToken
RegCloseKey
RegQueryValueExA
RegOpenKeyExA
CloseEventLog
ClearEventLogA
OpenEventLogA
RegSetValueExA
RegCreateKeyExA
FreeSid
SetSecurityDescriptorDacl
AddAccessAllowedAce
InitializeAcl
GetLengthSid
AllocateAndInitializeSid
InitializeSecurityDescriptor
RegOpenKeyA
AdjustTokenPrivileges

shell32

SHGetSpecialFolderPathA

msvcrt

strstr
_ftol
ceil
putchar
memmove
__CxxFrameHandler
puts
_CxxThrowException
??2@YAPAXI@Z
calloc
??1type_info@@UAE@XZ
_initterm
_adjust_fdiv
rand
sprintf
strncpy
free
malloc
_except_handler3
strrchr
_stricmp
exit
_beginthreadex
??3@YAXPAX@Z
_strrev
atoi

ws2_32

sendto
WSASocketA
htonl
getsockname
connect
inet_addr
send
closesocket
select
recv
socket
gethostbyname
htons
setsockopt
WSAIoctl
WSACleanup
WSAStartup

msvcp60

?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
?_Xran@std@@YAXXZ
?_Split@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXXZ
?_Eos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEXI@Z
?_Refcnt@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEAAEPBD@Z
?_Grow@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAE_NI_N@Z
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
?_C@?1??_Nullstr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@CAPBDXZ@4DB
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAEX_N@Z

Sections

.text
Size: 69KB - Virtual size: 69KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.data
.rdata
.reloc
.rsrc/BITMAP/103.bmp
.rsrc/MANIFEST/1
.xml
.rsrc/MENU/102
.rsrc/version.txt
.text

Sharing

General

Malware Config

Signatures

Files

12ef9c569459f5606cfe4e7ab7c49c0b

Headers

File Characteristics

Imports

kernel32

user32

advapi32

shell32

msvcrt

ws2_32

msvcp60

Sections

.text Size: 69KB - Virtual size: 69KB

.rdata Size: 11KB - Virtual size: 10KB

.data Size: 8KB - Virtual size: 10KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 69KB - Virtual size: 69KB

.rdata
Size: 11KB - Virtual size: 10KB

.data
Size: 8KB - Virtual size: 10KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB