Behavioral task
behavioral1
Sample
8bd3c3b71bf14be6d9ef4742c2ae4669_JaffaCakes118.exe
Resource
win7-20240729-en
General
-
Target
8bd3c3b71bf14be6d9ef4742c2ae4669_JaffaCakes118
-
Size
81KB
-
MD5
8bd3c3b71bf14be6d9ef4742c2ae4669
-
SHA1
7de6cbfabe9129e29e977a6762824cd07fdcf40c
-
SHA256
b8ba6e420bcd295959e75658770fbb1b09aa28a28c8a2ea19e490cf6f6038286
-
SHA512
51d80ed768a5d263bf3d7a0773f4cf6e04b61c5a33465683cf89032c76cbbb4568f86fd05e563c87e9d53a33042d119dff7437142a4e039046b2d381190093f9
-
SSDEEP
768:ABr+tjFqTPkAlfztB1lr6an3smTA8uvm2DzooEeU2FU+LnS8v:wyRUHlrL1lr6an3TLuvm23oV6UUS
Malware Config
Signatures
-
Detect XtremeRAT payload 1 IoCs
resource yara_rule sample family_xtremerat -
Xtremerat family
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8bd3c3b71bf14be6d9ef4742c2ae4669_JaffaCakes118
Files
-
8bd3c3b71bf14be6d9ef4742c2ae4669_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
UPX0 Size: 60KB - Virtual size: 60KB
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
UPX1 Size: 19KB - Virtual size: 20KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 1KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE