General

  • Target

    4eb0322fa19d6aa9af385b6ea4a77292_JaffaCakes118

  • Size

    73KB

  • Sample

    240716-rlwq4awhjl

  • MD5

    4eb0322fa19d6aa9af385b6ea4a77292

  • SHA1

    2cb52545cb95265d1110a9b4575ef5109dee1e9c

  • SHA256

    f9a7da39b61f5dec86a9513247643276374e03a2538081ffe2ab5c0c56483abd

  • SHA512

    1447abbf3d658084364598849a7f22e2bf800dbe38e20368c1684049753cd522455444f9fb5a33651096fc699e75a96dfc653ded07e5504730f3c92a20bd1ccf

  • SSDEEP

    1536:HGFJkVFLP7BZ4OImlQJjQjweI8uY37BZohufkm+6SyxS:msrP34OIqJq145fl9xS

Malware Config

Targets

    • Target

      4eb0322fa19d6aa9af385b6ea4a77292_JaffaCakes118

    • Size

      73KB

    • MD5

      4eb0322fa19d6aa9af385b6ea4a77292

    • SHA1

      2cb52545cb95265d1110a9b4575ef5109dee1e9c

    • SHA256

      f9a7da39b61f5dec86a9513247643276374e03a2538081ffe2ab5c0c56483abd

    • SHA512

      1447abbf3d658084364598849a7f22e2bf800dbe38e20368c1684049753cd522455444f9fb5a33651096fc699e75a96dfc653ded07e5504730f3c92a20bd1ccf

    • SSDEEP

      1536:HGFJkVFLP7BZ4OImlQJjQjweI8uY37BZohufkm+6SyxS:msrP34OIqJq145fl9xS

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks