General
-
Target
389fd48d3efa2d4f19e08f979c6c20de_JaffaCakes118
-
Size
200KB
-
Sample
240711-lr42rs1djm
-
MD5
389fd48d3efa2d4f19e08f979c6c20de
-
SHA1
ab044a1326cac533dee82de118f745ec04d65ec2
-
SHA256
87a04a2d6b53178cd1eb0f691aa644d0610927314c3cfac6467c6434492d8e7f
-
SHA512
2d703d90ca9f0da6b9f0e441dda33bee8340847114e62e6b6213e5898faaa51dd3302e8d0919f08fbdf4e7d40734a8b0afe6ed4428b7f384e2267da671f6c837
-
SSDEEP
1536:caEj8yhyguAiQ/cBJWumC7jzestv3mQoMN2peweG/ChXbQwvA5HvDpTg4vfJ9+:dSvfiQUSKagWQd3wpwYPq4vf
Static task
static1
Behavioral task
behavioral1
Sample
389fd48d3efa2d4f19e08f979c6c20de_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
389fd48d3efa2d4f19e08f979c6c20de_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Malware Config
Extracted
xtremerat
godfathergos123.no-ip.biz
Targets
-
-
Target
389fd48d3efa2d4f19e08f979c6c20de_JaffaCakes118
-
Size
200KB
-
MD5
389fd48d3efa2d4f19e08f979c6c20de
-
SHA1
ab044a1326cac533dee82de118f745ec04d65ec2
-
SHA256
87a04a2d6b53178cd1eb0f691aa644d0610927314c3cfac6467c6434492d8e7f
-
SHA512
2d703d90ca9f0da6b9f0e441dda33bee8340847114e62e6b6213e5898faaa51dd3302e8d0919f08fbdf4e7d40734a8b0afe6ed4428b7f384e2267da671f6c837
-
SSDEEP
1536:caEj8yhyguAiQ/cBJWumC7jzestv3mQoMN2peweG/ChXbQwvA5HvDpTg4vfJ9+:dSvfiQUSKagWQd3wpwYPq4vf
Score10/10-
Detect XtremeRAT payload
-
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Suspicious use of SetThreadContext
-