General

  • Target

    584d2df58e1007ecff62731fe051f098_JaffaCakes118

  • Size

    19KB

  • Sample

    240718-vl3q7a1drf

  • MD5

    584d2df58e1007ecff62731fe051f098

  • SHA1

    cfd0693da1b8460bad4fda60d915d7b27e7e24ca

  • SHA256

    baa47267ddea8d380d8ad0660ce994add36076af8cd78cb2acd7316504c029b3

  • SHA512

    3e43e55856c2bd6d80e24700a7d8d28f9fa96f96f5c444f5dc94f57bb56a2f90d7b86154c3a2bf8d65f75a31776d2a5aace46d707499f1be4a7bf7d86bbce643

  • SSDEEP

    384:yHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSkGuw8b3h7R:fZfuHUvwDKP6kMp5GuxrP

Malware Config

Targets

    • Target

      584d2df58e1007ecff62731fe051f098_JaffaCakes118

    • Size

      19KB

    • MD5

      584d2df58e1007ecff62731fe051f098

    • SHA1

      cfd0693da1b8460bad4fda60d915d7b27e7e24ca

    • SHA256

      baa47267ddea8d380d8ad0660ce994add36076af8cd78cb2acd7316504c029b3

    • SHA512

      3e43e55856c2bd6d80e24700a7d8d28f9fa96f96f5c444f5dc94f57bb56a2f90d7b86154c3a2bf8d65f75a31776d2a5aace46d707499f1be4a7bf7d86bbce643

    • SSDEEP

      384:yHKZfuH87GowDqGoMwevqxP6k6zIDwPVBSkGuw8b3h7R:fZfuHUvwDKP6kMp5GuxrP

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks