Overview

overview

10

Static

static

3

f42d89264c...18.exe

windows7-x64

10

f42d89264c...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f42d89264c939921757f6565c601a601_JaffaCakes118

  • Size

    159KB

  • Sample

    240416-x9wznaaf42

  • MD5

    f42d89264c939921757f6565c601a601

  • SHA1

    1b3c67bf65dea8722ead3a884a0356202750e9d8

  • SHA256

    8848c33d2007af5e284ee75ccfd56a9f863a8c1036db49fce2106e51eaa62cca

  • SHA512

    cae607dcc9b71777f3d46401db621ff459f1adbf2104abe7cf288ca0da357a6ec368ddeaade56c2bb3088e381dd0e8489aed4b3665df9c8aaeb72e2c3a469506

  • SSDEEP

    3072:4rvEjatADQpWT1GnFo+tlGQpfUFWhC1T1YOo4D2Ekd3FaTlFAn:4DlAnTmFoKUEhEjo4Pp

Score
10/10
xtremeratpersistenceratspyware

Malware Config

Extracted

Family

xtremerat

C2

evil2dead1.no-ip.biz

Targets

    • Target

      f42d89264c939921757f6565c601a601_JaffaCakes118

    • Size

      159KB

    • MD5

      f42d89264c939921757f6565c601a601

    • SHA1

      1b3c67bf65dea8722ead3a884a0356202750e9d8

    • SHA256

      8848c33d2007af5e284ee75ccfd56a9f863a8c1036db49fce2106e51eaa62cca

    • SHA512

      cae607dcc9b71777f3d46401db621ff459f1adbf2104abe7cf288ca0da357a6ec368ddeaade56c2bb3088e381dd0e8489aed4b3665df9c8aaeb72e2c3a469506

    • SSDEEP

      3072:4rvEjatADQpWT1GnFo+tlGQpfUFWhC1T1YOo4D2Ekd3FaTlFAn:4DlAnTmFoKUEhEjo4Pp

    Score
    10/10
    xtremeratpersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Tasks