General
-
Target
367dbbc1f3933949a61549c0ea411d59_JaffaCakes118
-
Size
318KB
-
Sample
240710-1hjf2atenc
-
MD5
367dbbc1f3933949a61549c0ea411d59
-
SHA1
d18a359b3f3ec9ddcfd36e7c33d6f5de7de38ac9
-
SHA256
7e417ebc617ea942f6b08be5e1cfa4c3d8e24d6ec860cecbf36332bf7c55eef3
-
SHA512
d59a6b97386828a3ec7c4a92f06bafccff572508f1a7326f6b6330099eb93ff50ee2c06e96e7a65248b62467397167ce2e0b02885119dc51e24c648ee68d4ad3
-
SSDEEP
6144:l1db49+rEg024fpLZazEjvE/rbay19tSt4bO2BaDmeBJe59k4JgVZqITrwC:ljkArEN249AyE/rbaMct4bO2/VrGZj7
Behavioral task
behavioral1
Sample
367dbbc1f3933949a61549c0ea411d59_JaffaCakes118.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
367dbbc1f3933949a61549c0ea411d59_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
xtremerat
taher2361983.no-ip.biz
Targets
-
-
Target
367dbbc1f3933949a61549c0ea411d59_JaffaCakes118
-
Size
318KB
-
MD5
367dbbc1f3933949a61549c0ea411d59
-
SHA1
d18a359b3f3ec9ddcfd36e7c33d6f5de7de38ac9
-
SHA256
7e417ebc617ea942f6b08be5e1cfa4c3d8e24d6ec860cecbf36332bf7c55eef3
-
SHA512
d59a6b97386828a3ec7c4a92f06bafccff572508f1a7326f6b6330099eb93ff50ee2c06e96e7a65248b62467397167ce2e0b02885119dc51e24c648ee68d4ad3
-
SSDEEP
6144:l1db49+rEg024fpLZazEjvE/rbay19tSt4bO2BaDmeBJe59k4JgVZqITrwC:ljkArEN249AyE/rbaMct4bO2/VrGZj7
Score10/10-
Detect XtremeRAT payload
-
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext
-