Overview

overview

10

Static

static

10

e385b4d968...18.exe

windows7-x64

10

e385b4d968...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e385b4d968eb4eebcef184812aa73d59_JaffaCakes118

  • Size

    187KB

  • Sample

    240406-29sz8aee99

  • MD5

    e385b4d968eb4eebcef184812aa73d59

  • SHA1

    419d009e271e2275102ff4a9fa23ed3b5bbd6ee4

  • SHA256

    992084b98896a304eeae23ed0176ce5782e969e57e02664d7949b43e9474c9a5

  • SHA512

    b665c1d409f4d1290f91a8801b20ba65ffad91920155246fe5631020ca64fa0d53494bde7af8b7d2e0de888c1c4c283002349e308e908af0de67c52d6940f024

  • SSDEEP

    3072:C44rj/lalvjK9xq67zt9lgRtFAvjK9xq67zt9lgRtFKo:pZNjWq6mROjWq6mRm

Score
10/10
xtremeratpersistenceratspyware

Malware Config

Extracted

Family

xtremerat

C2

ayyak.zapto.org

Targets

    • Target

      e385b4d968eb4eebcef184812aa73d59_JaffaCakes118

    • Size

      187KB

    • MD5

      e385b4d968eb4eebcef184812aa73d59

    • SHA1

      419d009e271e2275102ff4a9fa23ed3b5bbd6ee4

    • SHA256

      992084b98896a304eeae23ed0176ce5782e969e57e02664d7949b43e9474c9a5

    • SHA512

      b665c1d409f4d1290f91a8801b20ba65ffad91920155246fe5631020ca64fa0d53494bde7af8b7d2e0de888c1c4c283002349e308e908af0de67c52d6940f024

    • SSDEEP

      3072:C44rj/lalvjK9xq67zt9lgRtFAvjK9xq67zt9lgRtFKo:pZNjWq6mROjWq6mRm

    Score
    10/10
    xtremeratpersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Modifies Installed Components in the registry

      persistence

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks