General

  • Target

    6015d3b7214b56bd72ac6bbd255917cc_JaffaCakes118

  • Size

    268KB

  • Sample

    240720-mbmm8a1dre

  • MD5

    6015d3b7214b56bd72ac6bbd255917cc

  • SHA1

    7e407bc983f2be587441b95693cf2603a61a2179

  • SHA256

    b42a870f32b6ad19437ba20345444ff89c2984608b8659b0dc1c7e2ce4f677cb

  • SHA512

    3c794004f6ee61e756cc34cb8a83dc61d4a63e5d286c82bfabaa2c8d197c2120ab7376a8cf9c4d61bf324cac4ec6d4f91abdbec29be6fe63b42bb118c1d593ad

  • SSDEEP

    1536:BSFkyzADIlxhyiXSyqZRQPKBKtWaMWrm91TFhuzGK:oFdgIlrXSyLPCfB1TSzG

Malware Config

Targets

    • Target

      6015d3b7214b56bd72ac6bbd255917cc_JaffaCakes118

    • Size

      268KB

    • MD5

      6015d3b7214b56bd72ac6bbd255917cc

    • SHA1

      7e407bc983f2be587441b95693cf2603a61a2179

    • SHA256

      b42a870f32b6ad19437ba20345444ff89c2984608b8659b0dc1c7e2ce4f677cb

    • SHA512

      3c794004f6ee61e756cc34cb8a83dc61d4a63e5d286c82bfabaa2c8d197c2120ab7376a8cf9c4d61bf324cac4ec6d4f91abdbec29be6fe63b42bb118c1d593ad

    • SSDEEP

      1536:BSFkyzADIlxhyiXSyqZRQPKBKtWaMWrm91TFhuzGK:oFdgIlrXSyLPCfB1TSzG

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks