General
-
Target
6015d3b7214b56bd72ac6bbd255917cc_JaffaCakes118
-
Size
268KB
-
Sample
240720-mbmm8a1dre
-
MD5
6015d3b7214b56bd72ac6bbd255917cc
-
SHA1
7e407bc983f2be587441b95693cf2603a61a2179
-
SHA256
b42a870f32b6ad19437ba20345444ff89c2984608b8659b0dc1c7e2ce4f677cb
-
SHA512
3c794004f6ee61e756cc34cb8a83dc61d4a63e5d286c82bfabaa2c8d197c2120ab7376a8cf9c4d61bf324cac4ec6d4f91abdbec29be6fe63b42bb118c1d593ad
-
SSDEEP
1536:BSFkyzADIlxhyiXSyqZRQPKBKtWaMWrm91TFhuzGK:oFdgIlrXSyLPCfB1TSzG
Static task
static1
Behavioral task
behavioral1
Sample
6015d3b7214b56bd72ac6bbd255917cc_JaffaCakes118.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
6015d3b7214b56bd72ac6bbd255917cc_JaffaCakes118.exe
Resource
win10v2004-20240709-en
Malware Config
Targets
-
-
Target
6015d3b7214b56bd72ac6bbd255917cc_JaffaCakes118
-
Size
268KB
-
MD5
6015d3b7214b56bd72ac6bbd255917cc
-
SHA1
7e407bc983f2be587441b95693cf2603a61a2179
-
SHA256
b42a870f32b6ad19437ba20345444ff89c2984608b8659b0dc1c7e2ce4f677cb
-
SHA512
3c794004f6ee61e756cc34cb8a83dc61d4a63e5d286c82bfabaa2c8d197c2120ab7376a8cf9c4d61bf324cac4ec6d4f91abdbec29be6fe63b42bb118c1d593ad
-
SSDEEP
1536:BSFkyzADIlxhyiXSyqZRQPKBKtWaMWrm91TFhuzGK:oFdgIlrXSyLPCfB1TSzG
Score10/10-
Detect XtremeRAT payload
-
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-