General

  • Target

    367dbbc1f3933949a61549c0ea411d59_JaffaCakes118

  • Size

    318KB

  • Sample

    240710-1hjf2atenc

  • MD5

    367dbbc1f3933949a61549c0ea411d59

  • SHA1

    d18a359b3f3ec9ddcfd36e7c33d6f5de7de38ac9

  • SHA256

    7e417ebc617ea942f6b08be5e1cfa4c3d8e24d6ec860cecbf36332bf7c55eef3

  • SHA512

    d59a6b97386828a3ec7c4a92f06bafccff572508f1a7326f6b6330099eb93ff50ee2c06e96e7a65248b62467397167ce2e0b02885119dc51e24c648ee68d4ad3

  • SSDEEP

    6144:l1db49+rEg024fpLZazEjvE/rbay19tSt4bO2BaDmeBJe59k4JgVZqITrwC:ljkArEN249AyE/rbaMct4bO2/VrGZj7

Malware Config

Extracted

Family

xtremerat

C2

taher2361983.no-ip.biz

Targets

    • Target

      367dbbc1f3933949a61549c0ea411d59_JaffaCakes118

    • Size

      318KB

    • MD5

      367dbbc1f3933949a61549c0ea411d59

    • SHA1

      d18a359b3f3ec9ddcfd36e7c33d6f5de7de38ac9

    • SHA256

      7e417ebc617ea942f6b08be5e1cfa4c3d8e24d6ec860cecbf36332bf7c55eef3

    • SHA512

      d59a6b97386828a3ec7c4a92f06bafccff572508f1a7326f6b6330099eb93ff50ee2c06e96e7a65248b62467397167ce2e0b02885119dc51e24c648ee68d4ad3

    • SSDEEP

      6144:l1db49+rEg024fpLZazEjvE/rbay19tSt4bO2BaDmeBJe59k4JgVZqITrwC:ljkArEN249AyE/rbaMct4bO2/VrGZj7

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks