General

  • Target

    a3ae02290ae3bb37deeb449b12e022ed_JaffaCakes118

  • Size

    80KB

  • Sample

    240817-xaj6tazhjg

  • MD5

    a3ae02290ae3bb37deeb449b12e022ed

  • SHA1

    092d55c79587c7e9523db0d06f93ffab2cc672ce

  • SHA256

    92d069767addfc519889e919de97f421d31ebfe1c379809bff507c52bf962862

  • SHA512

    9dea9db33b29727db3e683b5ce4951b21febdd5d5a5a05f3d23b8a1c34d88c119a1d11cac2074fdfe0f5ae8ce213d85af5ac16f4896f003ccb7cb2ff8cbbfaac

  • SSDEEP

    768:0Br+tjFqTtTlJztWsvp8W3h/OXw1Z1jvzoWnfEeU2F4XnA:kyRUhlRZvp8W3PrjLoWnO64Xn

Malware Config

Targets

    • Target

      a3ae02290ae3bb37deeb449b12e022ed_JaffaCakes118

    • Size

      80KB

    • MD5

      a3ae02290ae3bb37deeb449b12e022ed

    • SHA1

      092d55c79587c7e9523db0d06f93ffab2cc672ce

    • SHA256

      92d069767addfc519889e919de97f421d31ebfe1c379809bff507c52bf962862

    • SHA512

      9dea9db33b29727db3e683b5ce4951b21febdd5d5a5a05f3d23b8a1c34d88c119a1d11cac2074fdfe0f5ae8ce213d85af5ac16f4896f003ccb7cb2ff8cbbfaac

    • SSDEEP

      768:0Br+tjFqTtTlJztWsvp8W3h/OXw1Z1jvzoWnfEeU2F4XnA:kyRUhlRZvp8W3PrjLoWnO64Xn

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks