General

  • Target

    5ac9908c89ef0cc377e3415d98c6fae1_JaffaCakes118

  • Size

    145KB

  • Sample

    240719-g3lx4szdkh

  • MD5

    5ac9908c89ef0cc377e3415d98c6fae1

  • SHA1

    45efca782cc8a237a2ee89e3fcef1366ad13c83e

  • SHA256

    7bc122eec937e2e1da01f59deb102098cd6324f41a190c16e31a7b49081baeb4

  • SHA512

    42e6bbaa2f6ddadc7780fdfaecb7fd707e12b8577c1f56996b9b22b7c8352402f881673a5c4decd1684f61e6b8584b25dc072fbd578308ce5f047267f2e12b0a

  • SSDEEP

    3072:YaN2APVMEd4kuBSf2AY/KMMMMMMMMMMMMMMMMMMMD7V9zl7oQAxBWWMMMMMMMMMX:YZAPVd4kl2SMMMMMMMMMMMMMMMMMM+FK

Malware Config

Targets

    • Target

      5ac9908c89ef0cc377e3415d98c6fae1_JaffaCakes118

    • Size

      145KB

    • MD5

      5ac9908c89ef0cc377e3415d98c6fae1

    • SHA1

      45efca782cc8a237a2ee89e3fcef1366ad13c83e

    • SHA256

      7bc122eec937e2e1da01f59deb102098cd6324f41a190c16e31a7b49081baeb4

    • SHA512

      42e6bbaa2f6ddadc7780fdfaecb7fd707e12b8577c1f56996b9b22b7c8352402f881673a5c4decd1684f61e6b8584b25dc072fbd578308ce5f047267f2e12b0a

    • SSDEEP

      3072:YaN2APVMEd4kuBSf2AY/KMMMMMMMMMMMMMMMMMMMD7V9zl7oQAxBWWMMMMMMMMMX:YZAPVd4kl2SMMMMMMMMMMMMMMMMMM+FK

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks