Overview

overview

10

Static

static

10

3a47e97fc8...18.exe

windows7-x64

10

3a47e97fc8...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3a47e97fc8141a1d42ccdc0a76deb49a_JaffaCakes118

  • Size

    40KB

  • Sample

    240512-qfzecsgb2y

  • MD5

    3a47e97fc8141a1d42ccdc0a76deb49a

  • SHA1

    9a97c1d70a54f71fcb6f9b682b5abea6c0c916f3

  • SHA256

    a5b3ff6df1b0f30a66a5902987d3fece04f0419abe9effa5a1565ce129a58e50

  • SHA512

    a74c6409b50955cb501ebe273587c22ca888c3b211bea02d3bc8568ef510611ed3dfe7107f637fc1f87f3ea826155aa189f7fabedb30526dd6add10e445176f5

  • SSDEEP

    768:3E9hghdN12Ozhiow2Gkm6+c3//UxC9Pezo:3u+zMOlw2GkmS3Tao

Score
10/10
xtremeratpersistenceratspyware

Malware Config

Targets

    • Target

      3a47e97fc8141a1d42ccdc0a76deb49a_JaffaCakes118

    • Size

      40KB

    • MD5

      3a47e97fc8141a1d42ccdc0a76deb49a

    • SHA1

      9a97c1d70a54f71fcb6f9b682b5abea6c0c916f3

    • SHA256

      a5b3ff6df1b0f30a66a5902987d3fece04f0419abe9effa5a1565ce129a58e50

    • SHA512

      a74c6409b50955cb501ebe273587c22ca888c3b211bea02d3bc8568ef510611ed3dfe7107f637fc1f87f3ea826155aa189f7fabedb30526dd6add10e445176f5

    • SSDEEP

      768:3E9hghdN12Ozhiow2Gkm6+c3//UxC9Pezo:3u+zMOlw2GkmS3Tao

    Score
    10/10
    xtremeratpersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Modifies Installed Components in the registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks