Overview

overview

10

Static

static

3

e574c5b4bd...18.exe

windows7-x64

10

e574c5b4bd...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e574c5b4bd8c3aa1bb01f4cec4e665e7_JaffaCakes118

  • Size

    243KB

  • Sample

    240407-vwz32saa75

  • MD5

    e574c5b4bd8c3aa1bb01f4cec4e665e7

  • SHA1

    2c7687500578f37691e6ea794c39e2780f4362f1

  • SHA256

    a0da3171a44b064723a9c4cc910ea7e8d8a146aeeff6fdfd8d17ea2f3714e82a

  • SHA512

    8472e794189b29857b56c0b5f6581effd18203454cc1901758ae663e2c2a467690504e1a4dceb9673820494811eb999405be0098950865accffb8e48775b991d

  • SSDEEP

    3072:XFd2Afoka0uMMGYmKlMCJ+UrxkCkK9a7+Z3wCYdj8vK1HDvhk1eSkDyfCnewUmGT:1jQwuYKs7M3jvEu1nkaCneT3NmEQ6

Score
10/10
xtremeratpersistenceratspyware

Malware Config

Extracted

Family

xtremerat

C2

umtakcicek.dyndns.org

ࠁ谀umtakcicek.dyndns.org

Targets

    • Target

      e574c5b4bd8c3aa1bb01f4cec4e665e7_JaffaCakes118

    • Size

      243KB

    • MD5

      e574c5b4bd8c3aa1bb01f4cec4e665e7

    • SHA1

      2c7687500578f37691e6ea794c39e2780f4362f1

    • SHA256

      a0da3171a44b064723a9c4cc910ea7e8d8a146aeeff6fdfd8d17ea2f3714e82a

    • SHA512

      8472e794189b29857b56c0b5f6581effd18203454cc1901758ae663e2c2a467690504e1a4dceb9673820494811eb999405be0098950865accffb8e48775b991d

    • SSDEEP

      3072:XFd2Afoka0uMMGYmKlMCJ+UrxkCkK9a7+Z3wCYdj8vK1HDvhk1eSkDyfCnewUmGT:1jQwuYKs7M3jvEu1nkaCneT3NmEQ6

    Score
    10/10
    xtremeratpersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Modifies Installed Components in the registry

      persistence

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks