General

  • Target

    5fc6e305483d4768afaffb8fedc98748_JaffaCakes118

  • Size

    44KB

  • Sample

    240720-khl9xsyalc

  • MD5

    5fc6e305483d4768afaffb8fedc98748

  • SHA1

    d301c8ffb875126bbee511b1246addb8cef6ac0c

  • SHA256

    9cafeb4f30659c4f849b38af51856dcbd2b015504943515dc5266314782821af

  • SHA512

    a895a7d8233452946c3053b580518b8501395b590a462a58a74b670962784068c589a9817166b7b1f935da51365c92a1f6650b057ac7783ade304e2763e9b908

  • SSDEEP

    768:rBr+tjFqTPkAlfztB1lr6an3sWTA8uvm2DfOTwYPIkzoiQ:FyRUHlrL1lr6annTLuvm2buQkoiQ

Malware Config

Extracted

Family

xtremerat

C2

namehost.dyndns.org

Targets

    • Target

      5fc6e305483d4768afaffb8fedc98748_JaffaCakes118

    • Size

      44KB

    • MD5

      5fc6e305483d4768afaffb8fedc98748

    • SHA1

      d301c8ffb875126bbee511b1246addb8cef6ac0c

    • SHA256

      9cafeb4f30659c4f849b38af51856dcbd2b015504943515dc5266314782821af

    • SHA512

      a895a7d8233452946c3053b580518b8501395b590a462a58a74b670962784068c589a9817166b7b1f935da51365c92a1f6650b057ac7783ade304e2763e9b908

    • SSDEEP

      768:rBr+tjFqTPkAlfztB1lr6an3sWTA8uvm2DfOTwYPIkzoiQ:FyRUHlrL1lr6annTLuvm2buQkoiQ

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Deletes itself

    • Adds Run key to start application

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks