Overview

overview

10

Static

static

1

48233c394f...18.exe

windows7-x64

10

48233c394f...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    48233c394fd136a8e8c50f72c479818d_JaffaCakes118

  • Size

    120KB

  • Sample

    240515-1eh14ada7t

  • MD5

    48233c394fd136a8e8c50f72c479818d

  • SHA1

    a286371bf593d75e5932e75b0f7ccbd85e81b13b

  • SHA256

    054ce23e77868d3b70a3884cc350b48c75e9fa63b774df6718ca6ae608b00fdf

  • SHA512

    2fa9e8fe42cf7146a10963cb52a1e5d733e233147c5be2a3f0a6109695f1b2eb2b7ed0ebf5e56c96e7f61c5ca41d8ba55329d57d13d949382bdfbfc7aef422c3

  • SSDEEP

    3072:JHLPsKAmOc6GxqG20y8g6vxnqV32cm5dtJWgW73HC+VPpwk87VP+vCGx:JHzsIv4G20yqvxnG32cm5dtJWgW73HCW

Score
10/10
xtremeratpersistenceratspyware

Malware Config

Targets

    • Target

      48233c394fd136a8e8c50f72c479818d_JaffaCakes118

    • Size

      120KB

    • MD5

      48233c394fd136a8e8c50f72c479818d

    • SHA1

      a286371bf593d75e5932e75b0f7ccbd85e81b13b

    • SHA256

      054ce23e77868d3b70a3884cc350b48c75e9fa63b774df6718ca6ae608b00fdf

    • SHA512

      2fa9e8fe42cf7146a10963cb52a1e5d733e233147c5be2a3f0a6109695f1b2eb2b7ed0ebf5e56c96e7f61c5ca41d8ba55329d57d13d949382bdfbfc7aef422c3

    • SSDEEP

      3072:JHLPsKAmOc6GxqG20y8g6vxnqV32cm5dtJWgW73HC+VPpwk87VP+vCGx:JHzsIv4G20yqvxnG32cm5dtJWgW73HCW

    Score
    10/10
    xtremeratpersistenceratspyware

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks