General

  • Target

    3f929d9f5e8f604cdac45082536e6e95_JaffaCakes118

  • Size

    44KB

  • Sample

    240713-ba26qsydlp

  • MD5

    3f929d9f5e8f604cdac45082536e6e95

  • SHA1

    f35965d70433156f9f0f1e8ce5ca01d105b087aa

  • SHA256

    a09cb857e9c843df99551c6ae996eab1eefe0541d656329b9f8ba619a196a14f

  • SHA512

    2ab90985e2c17b802fd7364a954f7afd6e828d6a695fb06d29c99084609e4e83b3d88d4f559738a0a03c8535bd5def3e9404136f811b21e4b4333bc557daca95

  • SSDEEP

    768:rBr+tjFqTPkAlfztB1lr6an3smTA8uvm2DfOTwYPISzo3a:FyRUHlrL1lr6an3TLuvm2buQeo3a

Malware Config

Extracted

Family

xtremerat

C2

hakersmouhssine.no-ip.org

Targets

    • Target

      3f929d9f5e8f604cdac45082536e6e95_JaffaCakes118

    • Size

      44KB

    • MD5

      3f929d9f5e8f604cdac45082536e6e95

    • SHA1

      f35965d70433156f9f0f1e8ce5ca01d105b087aa

    • SHA256

      a09cb857e9c843df99551c6ae996eab1eefe0541d656329b9f8ba619a196a14f

    • SHA512

      2ab90985e2c17b802fd7364a954f7afd6e828d6a695fb06d29c99084609e4e83b3d88d4f559738a0a03c8535bd5def3e9404136f811b21e4b4333bc557daca95

    • SSDEEP

      768:rBr+tjFqTPkAlfztB1lr6an3smTA8uvm2DfOTwYPISzo3a:FyRUHlrL1lr6an3TLuvm2buQeo3a

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks