General
-
Target
4eee1e6212508897f97050bd98110bd8_JaffaCakes118
-
Size
24KB
-
Sample
240716-svjcsssakg
-
MD5
4eee1e6212508897f97050bd98110bd8
-
SHA1
9b69e4d25132ec4177bcbcb2bc4f6a36374e3dfc
-
SHA256
8f30682dd48b05a0ba88b84c25899eec32e96d36d69c6dcbf85be344acc0ac8f
-
SHA512
1e74861a6323b634c6c0c1b8893942b78ee60f83c1f670a4a693df2e523498073039fa933548f2f286237e4838ae1afa5965c42d9e94b1875e0651c35d88786a
-
SSDEEP
768:gNcVbatJFQL7tWwbN7prfRH1/0NJGMJxMLoI:gNcZatJWkgHb0NJO
Behavioral task
behavioral1
Sample
4eee1e6212508897f97050bd98110bd8_JaffaCakes118.exe
Resource
win7-20240704-en
Malware Config
Targets
-
-
Target
4eee1e6212508897f97050bd98110bd8_JaffaCakes118
-
Size
24KB
-
MD5
4eee1e6212508897f97050bd98110bd8
-
SHA1
9b69e4d25132ec4177bcbcb2bc4f6a36374e3dfc
-
SHA256
8f30682dd48b05a0ba88b84c25899eec32e96d36d69c6dcbf85be344acc0ac8f
-
SHA512
1e74861a6323b634c6c0c1b8893942b78ee60f83c1f670a4a693df2e523498073039fa933548f2f286237e4838ae1afa5965c42d9e94b1875e0651c35d88786a
-
SSDEEP
768:gNcVbatJFQL7tWwbN7prfRH1/0NJGMJxMLoI:gNcZatJWkgHb0NJO
-
Detect XtremeRAT payload
-
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-