gh0strat | jaffacakes118_Trojan[.]Win32[.]Gofy[.]jg[.]77a0d6512ea6460375cdb7866d598467

General

Target
jaffacakes118_Trojan.Win32.Gofy.jg.77a0d6512ea6460375cdb7866d598467
Size 118KB
Sample261018-v83ppsgz2s
SHA256 93f4810b0cd093600ecdcf1f42367b8a1c7f52bdb86749edbd60f332b232bfaa
MD5 77a0d6512ea6460375cdb7866d598467
SHA1 b59d25da40c86314445370c6b60d1895a36477cb
SHA512 55055d248df881de82e75d354e38e2b1c63781f35572642933b836d3e5c4a2569ed057e709995e0c84646fb979dc4862029ca493940b75f4712d9ea35871e8ae
SSDEEP 3072:Q+78iR1tZkGpEqL1Cys9BcwTDKEBGdyKu:Q+78iR1tK5qZk9BcwTGNQ
TLSH
T1ABC36C12FE8580FFE5A8113038EB777A9E3ABD545618DE876347EB950833151BB3234A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat gh0strat

Malware Config

Signatures

Family: Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat

Gh0st RAT payload 1 IoCs

resource	yara_rule
sample	family_gh0strat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
jaffacakes118_Trojan.Win32.Gofy.jg.77a0d6512ea6460375cdb7866d598467

File Explorer

jaffacakes118_Trojan.Win32.Gofy.jg.77a0d6512ea6460375cdb7866d598467

.exe 118KB

jaffacakes118_Trojan.Win32.Gofy.jg.77a0d6512ea6460375cdb7866d598467

IMPHASH 10e91eed08e523ccc040ba23b8972996
SHA256 93f4810b0cd093600ecdcf1f42367b8a1c7f52bdb86749edbd60f332b232bfaa
MD5 77a0d6512ea6460375cdb7866d598467
SHA1 b59d25da40c86314445370c6b60d1895a36477cb
SHA512 55055d248df881de82e75d354e38e2b1c63781f35572642933b836d3e5c4a2569ed057e709995e0c84646fb979dc4862029ca493940b75f4712d9ea35871e8ae
SSDEEP 3072:Q+78iR1tZkGpEqL1Cys9BcwTDKEBGdyKu:Q+78iR1tK5qZk9BcwTGNQ
TLSH
T1ABC36C12FE8580FFE5A8113038EB777A9E3ABD545618DE876347EB950833151BB3234A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Gh0st RAT payload
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

8613

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrcmpA ReadFile SetFilePointer GetModuleFileNameA SetUnhandledExceptionFilter Sleep ReleaseMutex CreateMutexA GetLastError SetFileAttributesA CreateDirectoryA GetSystemDirectoryA GetCurrentThreadId GetStartupInfoA GetModuleHandleA SetLastError lstrcmpiA lstrcpyA FindResourceA LoadResource CreateFileA SystemTimeToFileTime LocalFileTimeToFileTime SetFileTime SizeofResource lstrlenA WriteFile CloseHandle ExitProcess GetWindowsDirectoryA LoadLibraryA GetProcAddress FreeLibrary lstrcatA GetCommandLineA

user32

GetMessageA wsprintfA GetInputState PostThreadMessageA

advapi32

CreateServiceA CloseServiceHandle RegCreateKeyExA RegSetValueExA RegDeleteKeyA RegDeleteValueA RegQueryValueExA RegOpenKeyExA RegCloseKey StartServiceA OpenServiceA OpenSCManagerA

msvcrt

exit realloc malloc _except_handler3 strchr strtok ??2@YAPAXI@Z __CxxFrameHandler _CxxThrowException ??3@YAXPAX@Z strstr ??1type_info@@UAE@XZ _exit _XcptFilter _strrev _acmdln __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _controlfp

Sharing