Overview

overview

10

Static

static

10

JaffaCakes...11.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    JaffaCakes118_075741c6f27707791196b34dec6d9011

  • Size

    629KB

  • Sample

    250520-zgyc5acl4t

  • MD5

    075741c6f27707791196b34dec6d9011

  • SHA1

    1be5270b06de8c3049fd6540d6d9e1639e975863

  • SHA256

    93b60abed463113befc3d8d701464143312dce28fe8649be68321c8d90584c21

  • SHA512

    0134ba7a48669fbdb2ea2b5ae3bd93a1b4f539c22da94322dd53ed2232a6496ab29795bc2f0021c3edc8074620ca9cde2939cbd19e7bba7a342367e3abbf7f5b

  • SSDEEP

    12288:AM5HYC52oxL3aKHx5r+TuxPhNWwgsAO3otVtO:AM5HYC0w3aKHx5r+TuxPhpgpOmVtO

Score
10/10
gh0stratdiscoverypersistencerat

Malware Config

Targets

    • Target

      JaffaCakes118_075741c6f27707791196b34dec6d9011

    • Size

      629KB

    • MD5

      075741c6f27707791196b34dec6d9011

    • SHA1

      1be5270b06de8c3049fd6540d6d9e1639e975863

    • SHA256

      93b60abed463113befc3d8d701464143312dce28fe8649be68321c8d90584c21

    • SHA512

      0134ba7a48669fbdb2ea2b5ae3bd93a1b4f539c22da94322dd53ed2232a6496ab29795bc2f0021c3edc8074620ca9cde2939cbd19e7bba7a342367e3abbf7f5b

    • SSDEEP

      12288:AM5HYC52oxL3aKHx5r+TuxPhNWwgsAO3otVtO:AM5HYC0w3aKHx5r+TuxPhpgpOmVtO

    Score
    10/10
    gh0stratdiscoverypersistencerat

    • Gh0st RAT payload

    • Gh0strat

      Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.

      ratgh0strat

    • Gh0strat family

      gh0strat

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks