Overview

overview

10

Static

static

3

f9cc5a45a9...18.exe

windows7-x64

10

f9cc5a45a9...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f9cc5a45a993e282b17d25c0f482a9d0_JaffaCakes118

  • Size

    51KB

  • Sample

    240419-h8elnabg87

  • MD5

    f9cc5a45a993e282b17d25c0f482a9d0

  • SHA1

    393d8b911b0818d74e24a762210244a23bf3be2d

  • SHA256

    f8f0a33c1f29dffef842e68b0269a48f9b900fd6178540d36953a2277b636dae

  • SHA512

    1f583844006cf24c25dd60177f4afd494c351635975152b465d767588b488ef21ed8bcb6a48f242282891267a49042c64ab959f49e7311a4a6a3acca2bfe63f2

  • SSDEEP

    1536:fxFRLVwACE+uCDf1tszrRZts8xfoGvfzP4kwrRaIl:f3cztAfoGvf7EPl

Score
10/10
xtremeratpersistenceratspyware

Malware Config

Extracted

Family

xtremerat

C2

bibib.no-ip.info

Targets

    • Target

      f9cc5a45a993e282b17d25c0f482a9d0_JaffaCakes118

    • Size

      51KB

    • MD5

      f9cc5a45a993e282b17d25c0f482a9d0

    • SHA1

      393d8b911b0818d74e24a762210244a23bf3be2d

    • SHA256

      f8f0a33c1f29dffef842e68b0269a48f9b900fd6178540d36953a2277b636dae

    • SHA512

      1f583844006cf24c25dd60177f4afd494c351635975152b465d767588b488ef21ed8bcb6a48f242282891267a49042c64ab959f49e7311a4a6a3acca2bfe63f2

    • SSDEEP

      1536:fxFRLVwACE+uCDf1tszrRZts8xfoGvfzP4kwrRaIl:f3cztAfoGvf7EPl

    Score
    10/10
    xtremeratpersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Modifies Installed Components in the registry

      persistence

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks