General
-
Target
fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118
-
Size
167KB
-
Sample
240420-te5frscc23
-
MD5
fd203670a1093f4efd07d570cf4ffee7
-
SHA1
04e4ff6219d57cab37db772130b7ec1ad8087e51
-
SHA256
9d162ad483c6ce5c325a3ca5329e4ca110c40d8b0595fa58bc3dc2db0ab47661
-
SHA512
3bf5583beba5e7d2c2bbedbef7679803b3b1963fb16da2d4891ee5ea8c1235a16756264608c4a18a24712e870e36fd142261bef00d4f619320cd305d5ebd5051
-
SSDEEP
3072:4xlgiukdSZJEpJnohdEJ1MtAe7gn17/C7fyWNCHeODrIN1xuAlWH:Klgil8egEJzqb/4Qxu2WH
Static task
static1
Behavioral task
behavioral1
Sample
fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118.exe
Resource
win10v2004-20240226-en
Malware Config
Targets
-
-
Target
fd203670a1093f4efd07d570cf4ffee7_JaffaCakes118
-
Size
167KB
-
MD5
fd203670a1093f4efd07d570cf4ffee7
-
SHA1
04e4ff6219d57cab37db772130b7ec1ad8087e51
-
SHA256
9d162ad483c6ce5c325a3ca5329e4ca110c40d8b0595fa58bc3dc2db0ab47661
-
SHA512
3bf5583beba5e7d2c2bbedbef7679803b3b1963fb16da2d4891ee5ea8c1235a16756264608c4a18a24712e870e36fd142261bef00d4f619320cd305d5ebd5051
-
SSDEEP
3072:4xlgiukdSZJEpJnohdEJ1MtAe7gn17/C7fyWNCHeODrIN1xuAlWH:Klgil8egEJzqb/4Qxu2WH
Score10/10-
Detect XtremeRAT payload
-
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Modifies Installed Components in the registry
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-