General

  • Target

    389fd48d3efa2d4f19e08f979c6c20de_JaffaCakes118

  • Size

    200KB

  • Sample

    240711-lr42rs1djm

  • MD5

    389fd48d3efa2d4f19e08f979c6c20de

  • SHA1

    ab044a1326cac533dee82de118f745ec04d65ec2

  • SHA256

    87a04a2d6b53178cd1eb0f691aa644d0610927314c3cfac6467c6434492d8e7f

  • SHA512

    2d703d90ca9f0da6b9f0e441dda33bee8340847114e62e6b6213e5898faaa51dd3302e8d0919f08fbdf4e7d40734a8b0afe6ed4428b7f384e2267da671f6c837

  • SSDEEP

    1536:caEj8yhyguAiQ/cBJWumC7jzestv3mQoMN2peweG/ChXbQwvA5HvDpTg4vfJ9+:dSvfiQUSKagWQd3wpwYPq4vf

Malware Config

Extracted

Family

xtremerat

C2

godfathergos123.no-ip.biz

Targets

    • Target

      389fd48d3efa2d4f19e08f979c6c20de_JaffaCakes118

    • Size

      200KB

    • MD5

      389fd48d3efa2d4f19e08f979c6c20de

    • SHA1

      ab044a1326cac533dee82de118f745ec04d65ec2

    • SHA256

      87a04a2d6b53178cd1eb0f691aa644d0610927314c3cfac6467c6434492d8e7f

    • SHA512

      2d703d90ca9f0da6b9f0e441dda33bee8340847114e62e6b6213e5898faaa51dd3302e8d0919f08fbdf4e7d40734a8b0afe6ed4428b7f384e2267da671f6c837

    • SSDEEP

      1536:caEj8yhyguAiQ/cBJWumC7jzestv3mQoMN2peweG/ChXbQwvA5HvDpTg4vfJ9+:dSvfiQUSKagWQd3wpwYPq4vf

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks