gh0strat | jaffacakes118_HEUR[.]Trojan[.]Win32[.]Generic[.]2e3e70bd2e057d690b3021f0a3b86a52

General

Target
jaffacakes118_HEUR.Trojan.Win32.Generic.2e3e70bd2e057d690b3021f0a3b86a52
Size 119KB
Sample261014-bafbzady5x
SHA256 50fd99468cf4dddebd741d2051a2c773f3a4a4b75939dd1bfe1b54fd4f270aff
MD5 2e3e70bd2e057d690b3021f0a3b86a52
SHA1 eabcc300e60f2cfcdcc0c8f3c442279c5024bec7
SHA512 2acbcf5285a308de224c04110e92963e29693bbc64a216bfb56397d59a71aa9335a31d92d15fe61e0bb8926ee75bbe34e4e48e8632d032e1d26fd4d80e147570
SSDEEP 3072:XByBTIur7VsuRh/DBiE/BbNJFXaccDkatJeC:RyBTI0V1LDwaN3qccBJeC
TLSH
T1CEC37D01B69580F9E9A4153C98FF77B29A3BBD95CE048E832338FD5D2C72250A72535B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat gh0strat

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
jaffacakes118_HEUR.Trojan.Win32.Generic.2e3e70bd2e057d690b3021f0a3b86a52

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.2e3e70bd2e057d690b3021f0a3b86a52

.dll 119KB

jaffacakes118_HEUR.Trojan.Win32.Generic.2e3e70bd2e057d690b3021f0a3b86a52

SHA256 50fd99468cf4dddebd741d2051a2c773f3a4a4b75939dd1bfe1b54fd4f270aff
MD5 2e3e70bd2e057d690b3021f0a3b86a52
SHA1 eabcc300e60f2cfcdcc0c8f3c442279c5024bec7
SHA512 2acbcf5285a308de224c04110e92963e29693bbc64a216bfb56397d59a71aa9335a31d92d15fe61e0bb8926ee75bbe34e4e48e8632d032e1d26fd4d80e147570
SSDEEP 3072:XByBTIur7VsuRh/DBiE/BbNJFXaccDkatJeC:RyBTI0V1LDwaN3qccBJeC
TLSH
T1CEC37D01B69580F9E9A4153C98FF77B29A3BBD95CE048E832338FD5D2C72250A72535B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Gh0st RAT payload
Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

dd:a0:7c:eb:ad:85:9c:d0:92:2f:be:b9:60:4f:0b:34:4e:a0:29:08

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=Doctor Web Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Doctor Web Ltd.,ST=Saint-Petersburg,C=RU

Chains

Apr 1, 2008

CN=Doctor Web Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Doctor Web Ltd.,ST=Saint-Petersburg,C=RU

Subject

CN=VeriSign Time Stamping Services Signer - G2,O=VeriSign\, Inc.,C=US

Serial Number

38:25:d7:fa:f8:61:af:9e:f4:90:e7:26:b5:d6:5a:d5

Issuer

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jun 15, 2007 - Jun 14, 2012

Subject

CN=VeriSign Time Stamping Services CA,O=VeriSign\, Inc.,C=US

Serial Number

47:bf:19:95:df:8d:52:46:43:f7:db:6d:48:0d:31:a4

Issuer

CN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZA

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Dec 4, 2003 - Dec 3, 2013

Subject

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Serial Number

41:91:a1:5a:39:78:df:cf:49:65:66:38:1d:4c:75:c2

Issuer

OU=Class 3 Public Primary Certification Authority,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning

Timespan

Jul 16, 2004 - Jul 15, 2014

Subject

CN=Doctor Web Ltd.,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=Doctor Web Ltd.,ST=Saint-Petersburg,C=RU

Serial Number

75:54:74:39:e1:99:85:66:2a:5d:89:61:40:06:a3:f4

Issuer

CN=VeriSign Class 3 Code Signing 2004 CA,OU=VeriSign Trust Network+OU=Terms of use at https://www.verisign.com/rpa (c)04,O=VeriSign\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Sep 13, 2006 - Sep 12, 2008

Minor OS version

0

Major OS version

4

Entry point

75562

Magic Number

267

Subsystem

MAGE_SUBSYSTEM_UNKNOWN

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Name

.text

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

11KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.Silvana

Size

336B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_HEUR.Trojan.Win32.Generic.2e3e70bd2e057d690b3021f0a3b86a52

PE Signature issue

generic