General

  • Target

    6059b8088348c99daf91eba41c8c04a2_JaffaCakes118

  • Size

    244KB

  • Sample

    240720-23689s1fjl

  • MD5

    6059b8088348c99daf91eba41c8c04a2

  • SHA1

    9370f413e76a1df7aaee139ae0bacfd34f2a5863

  • SHA256

    8d75daeb859958eea86953c107b0e9c69ed549be4ada4bb875335308dcad11a9

  • SHA512

    ff8e103441792c53b9abf6f76a2392bcbc1ff12049380160ade30a9588e72cf315a0dc7dcc4f73ae45438cc491ab17013cf89edffc61ecdb09979915fe336d2f

  • SSDEEP

    6144:bA6rvzz6tsqG25OF/KzpAPMMQqPGtpLIwoJQF9VJ:bA67nQsqGKGKzFMQqP8JIUn3

Malware Config

Extracted

Family

xtremerat

C2

wer99.no-ip.org

Targets

    • Target

      6059b8088348c99daf91eba41c8c04a2_JaffaCakes118

    • Size

      244KB

    • MD5

      6059b8088348c99daf91eba41c8c04a2

    • SHA1

      9370f413e76a1df7aaee139ae0bacfd34f2a5863

    • SHA256

      8d75daeb859958eea86953c107b0e9c69ed549be4ada4bb875335308dcad11a9

    • SHA512

      ff8e103441792c53b9abf6f76a2392bcbc1ff12049380160ade30a9588e72cf315a0dc7dcc4f73ae45438cc491ab17013cf89edffc61ecdb09979915fe336d2f

    • SSDEEP

      6144:bA6rvzz6tsqG25OF/KzpAPMMQqPGtpLIwoJQF9VJ:bA67nQsqGKGKzFMQqP8JIUn3

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks