General
-
Target
52edff374e72e2b353537b72f9576d0f_JaffaCakes118
-
Size
40KB
-
Sample
240717-pd9xmstala
-
MD5
52edff374e72e2b353537b72f9576d0f
-
SHA1
fac700f58f94fcaf7948b7b15b41d29a49435d4a
-
SHA256
dc69d7a87c1f5180924146ece270da431074845be87b0655e58d280af8f3d466
-
SHA512
8f0e28ab27ab99afc6525401fd6e9f63665a93e1d2083b1104552a587608b2272180f0871517c3c17fff8a1467ac79a363116db5dc58a3f03bbc3c97f2529c43
-
SSDEEP
768:tE9hghdN12Ozhiow2Gkm6+c3/pBzNBwIldMzo+:tu+zMOlw2GkmS3/Bld8o+
Behavioral task
behavioral1
Sample
52edff374e72e2b353537b72f9576d0f_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
52edff374e72e2b353537b72f9576d0f_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Malware Config
Targets
-
-
Target
52edff374e72e2b353537b72f9576d0f_JaffaCakes118
-
Size
40KB
-
MD5
52edff374e72e2b353537b72f9576d0f
-
SHA1
fac700f58f94fcaf7948b7b15b41d29a49435d4a
-
SHA256
dc69d7a87c1f5180924146ece270da431074845be87b0655e58d280af8f3d466
-
SHA512
8f0e28ab27ab99afc6525401fd6e9f63665a93e1d2083b1104552a587608b2272180f0871517c3c17fff8a1467ac79a363116db5dc58a3f03bbc3c97f2529c43
-
SSDEEP
768:tE9hghdN12Ozhiow2Gkm6+c3/pBzNBwIldMzo+:tu+zMOlw2GkmS3/Bld8o+
Score10/10-
Detect XtremeRAT payload
-
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-