Overview

overview

10

Static

static

3

00f8af51c5...18.exe

windows7-x64

10

00f8af51c5...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    00f8af51c599a1c587db96baa968e306_JaffaCakes118

  • Size

    479KB

  • Sample

    240619-2q7z2azcrj

  • MD5

    00f8af51c599a1c587db96baa968e306

  • SHA1

    85cf2d60a0e9254792e2122b0fffb563ae36ccbb

  • SHA256

    4820c9a787707d31ed70c14fb1b99adf71d1de5f8f9f562f8292289fc2e9f1e7

  • SHA512

    846f42baea812e412021e47a94963edd05feabe2e6d3e0ee62cbcdd4c9af66659068e1c0027b0dd000d3902e928b92dc16c78fc972f8de3da3cfa8242fd59357

  • SSDEEP

    12288:RJVVod+G5B3K4FAtuHF//6oExJ7f+qy+38u:Ryf5B35FA6F36oExpGEsu

Score
10/10
xtremeratpersistenceratspyware

Malware Config

Targets

    • Target

      00f8af51c599a1c587db96baa968e306_JaffaCakes118

    • Size

      479KB

    • MD5

      00f8af51c599a1c587db96baa968e306

    • SHA1

      85cf2d60a0e9254792e2122b0fffb563ae36ccbb

    • SHA256

      4820c9a787707d31ed70c14fb1b99adf71d1de5f8f9f562f8292289fc2e9f1e7

    • SHA512

      846f42baea812e412021e47a94963edd05feabe2e6d3e0ee62cbcdd4c9af66659068e1c0027b0dd000d3902e928b92dc16c78fc972f8de3da3cfa8242fd59357

    • SSDEEP

      12288:RJVVod+G5B3K4FAtuHF//6oExJ7f+qy+38u:Ryf5B35FA6F36oExpGEsu

    Score
    10/10
    xtremeratpersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks