General

  • Target

    a4ad3d4e895ea8750347cd279327bf66_JaffaCakes118

  • Size

    90KB

  • Sample

    240818-aph6qsverh

  • MD5

    a4ad3d4e895ea8750347cd279327bf66

  • SHA1

    870ab51af6949f0ce5ef862244f41203f0f85a73

  • SHA256

    e9c77bb797d3675a8a3e8adcf41b8c67b522ab5c52a7bd5a974b1217b61b39ba

  • SHA512

    dc1aad4a0626e0a9b21b9f28452c83eee4ce39f74bbc1887083589c94cc64bafd2db5dd96a638caceef31191d6972283945583ecde6a39365ba4c90b3f947e87

  • SSDEEP

    1536:iBzvwX2UaEqiaaWb7eBEkdwMyEjUZ/8Pe/IZCHGf7Zz/Z57wcwsF1KeqJKDWsuK:iBvwmIqi07enyMy5kPeg8H6Nl574sF13

Malware Config

Targets

    • Target

      a4ad3d4e895ea8750347cd279327bf66_JaffaCakes118

    • Size

      90KB

    • MD5

      a4ad3d4e895ea8750347cd279327bf66

    • SHA1

      870ab51af6949f0ce5ef862244f41203f0f85a73

    • SHA256

      e9c77bb797d3675a8a3e8adcf41b8c67b522ab5c52a7bd5a974b1217b61b39ba

    • SHA512

      dc1aad4a0626e0a9b21b9f28452c83eee4ce39f74bbc1887083589c94cc64bafd2db5dd96a638caceef31191d6972283945583ecde6a39365ba4c90b3f947e87

    • SSDEEP

      1536:iBzvwX2UaEqiaaWb7eBEkdwMyEjUZ/8Pe/IZCHGf7Zz/Z57wcwsF1KeqJKDWsuK:iBvwmIqi07enyMy5kPeg8H6Nl574sF13

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks