Overview

overview

10

Static

static

3

073dc17713...18.exe

windows7-x64

10

073dc17713...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    073dc177133ad36604161bfefefbe2d4_JaffaCakes118

  • Size

    755KB

  • Sample

    240624-jht44a1ekc

  • MD5

    073dc177133ad36604161bfefefbe2d4

  • SHA1

    40506faa31c1221307bd8c70a8be72c2fd787e2b

  • SHA256

    f3a57ae875822d95f85f7fee3c74a4a41aca6a7a2f0532bcc0f9758861398000

  • SHA512

    c291015e19aad6ab3b7fa9649eb4205e3fab8d99381f8916f252b77c1c479bd0e010d69d11c801750c8206b5baeabb0ece02a93f44e35d725f8fcb596ceba283

  • SSDEEP

    12288:Nv5gM69PR/2C7zK9EItz4xA/lSOgYVjdwUwd1iXikemhrKXER:NxgV9t/Gz4I4kjdrEUbemdKX

Score
10/10
xtremeratpersistenceratspyware

Malware Config

Targets

    • Target

      073dc177133ad36604161bfefefbe2d4_JaffaCakes118

    • Size

      755KB

    • MD5

      073dc177133ad36604161bfefefbe2d4

    • SHA1

      40506faa31c1221307bd8c70a8be72c2fd787e2b

    • SHA256

      f3a57ae875822d95f85f7fee3c74a4a41aca6a7a2f0532bcc0f9758861398000

    • SHA512

      c291015e19aad6ab3b7fa9649eb4205e3fab8d99381f8916f252b77c1c479bd0e010d69d11c801750c8206b5baeabb0ece02a93f44e35d725f8fcb596ceba283

    • SSDEEP

      12288:Nv5gM69PR/2C7zK9EItz4xA/lSOgYVjdwUwd1iXikemhrKXER:NxgV9t/Gz4I4kjdrEUbemdKX

    Score
    10/10
    xtremeratpersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks