Overview

overview

10

Static

static

3

ecaa7d067d...18.exe

windows7-x64

10

ecaa7d067d...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ecaa7d067d5d92a4db34598d0897426c_JaffaCakes118

  • Size

    869KB

  • Sample

    240411-e2rqvscc32

  • MD5

    ecaa7d067d5d92a4db34598d0897426c

  • SHA1

    18108f1883a50d8e957a5f6783a7d7fd0ec73958

  • SHA256

    39b3e4377f07d38c73113bea15a84d8b02c3abffab19e8f9dec39ffc0d76128d

  • SHA512

    28b8579ec51fa60ad2ecb2c423455f89b22dd70b94d34fc548a9fe24a8253f8d58cd63cb383e9015506f443a1af06f0aeaf973167cc924112917991acd581475

  • SSDEEP

    24576:ZVqwhgLgQzG3T5ktqm49E9kbYMe3uCxTN+a:ZVqwhgEnD56qmb

Score
10/10
xtremeratpersistenceratspywareupx

Malware Config

Targets

    • Target

      ecaa7d067d5d92a4db34598d0897426c_JaffaCakes118

    • Size

      869KB

    • MD5

      ecaa7d067d5d92a4db34598d0897426c

    • SHA1

      18108f1883a50d8e957a5f6783a7d7fd0ec73958

    • SHA256

      39b3e4377f07d38c73113bea15a84d8b02c3abffab19e8f9dec39ffc0d76128d

    • SHA512

      28b8579ec51fa60ad2ecb2c423455f89b22dd70b94d34fc548a9fe24a8253f8d58cd63cb383e9015506f443a1af06f0aeaf973167cc924112917991acd581475

    • SSDEEP

      24576:ZVqwhgLgQzG3T5ktqm49E9kbYMe3uCxTN+a:ZVqwhgEnD56qmb

    Score
    10/10
    xtremeratpersistenceratspywareupx

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks