Overview

overview

10

Static

static

3

747bafbaca...18.exe

windows7-x64

10

747bafbaca...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    747bafbacafc3758fce7d5df3cc9fcd8_JaffaCakes118

  • Size

    240KB

  • Sample

    240726-r3qleaxfke

  • MD5

    747bafbacafc3758fce7d5df3cc9fcd8

  • SHA1

    f66b9e6a0864dce6311fb6f51193d27f00543cd4

  • SHA256

    28b35a838092debbdf8c73460aac22f63bfab54c84bfab72f430c15a8200e6e7

  • SHA512

    460c20b601e2f9355800480ff86f54027d9a5c70c1883fd48cbfe4f5a47687ac516fbb2c239923bf035a2535ae81d929d57a90917b4e6caae3fdd53527156d63

  • SSDEEP

    6144:r/d/LxOsoS2GeaaZwQ4TyQOI5JgpcvqNplcAjY3PKLo:rlk9S2GeaaKT0Iw5pmKLo

Score
10/10
xtremeratbootkitdiscoverypersistenceratspyware

Malware Config

Targets

    • Target

      747bafbacafc3758fce7d5df3cc9fcd8_JaffaCakes118

    • Size

      240KB

    • MD5

      747bafbacafc3758fce7d5df3cc9fcd8

    • SHA1

      f66b9e6a0864dce6311fb6f51193d27f00543cd4

    • SHA256

      28b35a838092debbdf8c73460aac22f63bfab54c84bfab72f430c15a8200e6e7

    • SHA512

      460c20b601e2f9355800480ff86f54027d9a5c70c1883fd48cbfe4f5a47687ac516fbb2c239923bf035a2535ae81d929d57a90917b4e6caae3fdd53527156d63

    • SSDEEP

      6144:r/d/LxOsoS2GeaaZwQ4TyQOI5JgpcvqNplcAjY3PKLo:rlk9S2GeaaKT0Iw5pmKLo

    Score
    10/10
    xtremeratbootkitdiscoverypersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks