gh0strat | 46b64dc3648ed93d1584a9f6989777aab39624541feb923a8ee6e2305f60e826 | Triage

Submit
Reports

Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

Static

static

3

JaffaCakes...77.exe

windows7-x64

JaffaCakes...77.exe

windows10-2004-x64

Sharing

General

Target

JaffaCakes118_6588f11ee0c5969265a6f035ea911477
Size

153KB
Sample

250311-qvba3stn18
MD5

6588f11ee0c5969265a6f035ea911477
SHA1

aa1c09436c36238004d37f50cd33723290f950d9
SHA256

46b64dc3648ed93d1584a9f6989777aab39624541feb923a8ee6e2305f60e826
SHA512

0203dc1bd9063eb097b02436bfab30d7d81a689c9464e1578a2487ab0015a387c683f7a264a0e252497ed8fe43f76075e84e30c02c2214a828d70b93780bd220
SSDEEP

3072:UUm3g3bxXMecA/VJ38CExBv13tQzdU9RMrAXu77wd2o:1mwpMecANJ38CEF3tYWMrAXu

Score

10^/10

gh0strat bootkit discovery persistence rat

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

JaffaCakes118_6588f11ee0c5969265a6f035ea911477.exe

Resource

win7-20250207-en

gh0strat bootkit discovery persistence rat

windows7-x64

17 signatures

150 seconds

Behavioral task

behavioral2

Sample

JaffaCakes118_6588f11ee0c5969265a6f035ea911477.exe

Resource

win10v2004-20250217-en

gh0strat bootkit discovery persistence rat

windows10-2004-x64

16 signatures

150 seconds

Malware Config

Targets

- Target
  
  JaffaCakes118_6588f11ee0c5969265a6f035ea911477
- Size
  
  153KB
- MD5
  
  6588f11ee0c5969265a6f035ea911477
- SHA1
  
  aa1c09436c36238004d37f50cd33723290f950d9
- SHA256
  
  46b64dc3648ed93d1584a9f6989777aab39624541feb923a8ee6e2305f60e826
- SHA512
  
  0203dc1bd9063eb097b02436bfab30d7d81a689c9464e1578a2487ab0015a387c683f7a264a0e252497ed8fe43f76075e84e30c02c2214a828d70b93780bd220
- SSDEEP
  
  3072:UUm3g3bxXMecA/VJ38CExBv13tQzdU9RMrAXu77wd2o:1mwpMecANJ38CEF3tYWMrAXu
Score

10^/10

gh0strat bootkit discovery persistence rat
- Gh0st RAT payload
- Gh0strat
  Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
  rat gh0strat
- Gh0strat family
  gh0strat
- Server Software Component: Terminal Services DLL
  persistence
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

Bootkit

Server Software Component

Terminal Services DLL

Privilege Escalation

Defense Evasion

Pre-OS Boot

Bootkit

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

gh0stratbootkitdiscoverypersistencerat

behavioral2

gh0stratbootkitdiscoverypersistencerat

© 2018-2025

Terms | Privacy