Overview

overview

10

Static

static

3

7701edc114...18.exe

windows7-x64

10

7701edc114...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    7701edc1146647bfa3adc72e1263fc14_JaffaCakes118

  • Size

    605KB

  • Sample

    240727-es57wszclf

  • MD5

    7701edc1146647bfa3adc72e1263fc14

  • SHA1

    73556b0d6578fb3341e4a5d8d6598d92cad96ba9

  • SHA256

    4f0f9ae838d580d2d59469980c33d1bdb35b3592db87079d8c860f86a3a8cd65

  • SHA512

    90acc4bf42562baa816fe9f006758a2268fb4dec925168e374a29496db1e56d3b0d0994e0acfb2fa14bc7c8f87c6532048421b9c255108dd840963055e82ebd3

  • SSDEEP

    12288:77MJe4vdTfCsrX8Cwt74khOUbKObQ3IhW4ulrVOyQ:77M/lfCMX85tXDHh6Q

Score
10/10
xtremeratdiscoverypersistenceratspyware

Malware Config

Targets

    • Target

      7701edc1146647bfa3adc72e1263fc14_JaffaCakes118

    • Size

      605KB

    • MD5

      7701edc1146647bfa3adc72e1263fc14

    • SHA1

      73556b0d6578fb3341e4a5d8d6598d92cad96ba9

    • SHA256

      4f0f9ae838d580d2d59469980c33d1bdb35b3592db87079d8c860f86a3a8cd65

    • SHA512

      90acc4bf42562baa816fe9f006758a2268fb4dec925168e374a29496db1e56d3b0d0994e0acfb2fa14bc7c8f87c6532048421b9c255108dd840963055e82ebd3

    • SSDEEP

      12288:77MJe4vdTfCsrX8Cwt74khOUbKObQ3IhW4ulrVOyQ:77M/lfCMX85tXDHh6Q

    Score
    10/10
    xtremeratdiscoverypersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks