Overview

overview

10

Static

static

3

1142c3701c...18.exe

windows7-x64

10

1142c3701c...18.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target
    1142c3701c716100cb437a8ccaa6f0dc_JaffaCakes118
  • Size 760KB
  • Sample240626-jslwgateqe
  • SHA256 c9e65e776ddd381ef2aad1b1ec44235f090c5fc34ee6e7e546eb9943a3e1ff3d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
xtremeratevasionpersistenceratspywarethemidaupx

Malware Config

Targets

    • Target
      1142c3701c716100cb437a8ccaa6f0dc_JaffaCakes118
    • Size 760KB
    • SHA256 c9e65e776ddd381ef2aad1b1ec44235f090c5fc34ee6e7e546eb9943a3e1ff3d
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    xtremeratevasionpersistenceratspywarethemidaupx

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      evasion

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks