General

  • Target

    a4fc95995e02deb89a8286949f25937b_JaffaCakes118

  • Size

    218KB

  • Sample

    240818-cma4fszdjh

  • MD5

    a4fc95995e02deb89a8286949f25937b

  • SHA1

    ec9d3477438caaa51f4ec22296fac7f983bb1dd9

  • SHA256

    dca8e090da536d269edba01e36e4890be35e1a2a3684cfdbff0df59568d5a817

  • SHA512

    ff1eefac1f322057c7560618a47ef970ed966a07fd75218b28038d16136d47a8d46117dd7f0824eabfb836d245a62d0bba42b870205e3a61f1c69cdb1a26d91c

  • SSDEEP

    6144:LYZeutlN34uS0reXjqTDVB9kGIrbk4wCyGyI8:0eutlW2rUMzsrw88

Malware Config

Extracted

Family

xtremerat

C2

yassinekk.no-ip.biz

yassinekk.no-ip.biz

Targets

    • Target

      a4fc95995e02deb89a8286949f25937b_JaffaCakes118

    • Size

      218KB

    • MD5

      a4fc95995e02deb89a8286949f25937b

    • SHA1

      ec9d3477438caaa51f4ec22296fac7f983bb1dd9

    • SHA256

      dca8e090da536d269edba01e36e4890be35e1a2a3684cfdbff0df59568d5a817

    • SHA512

      ff1eefac1f322057c7560618a47ef970ed966a07fd75218b28038d16136d47a8d46117dd7f0824eabfb836d245a62d0bba42b870205e3a61f1c69cdb1a26d91c

    • SSDEEP

      6144:LYZeutlN34uS0reXjqTDVB9kGIrbk4wCyGyI8:0eutlW2rUMzsrw88

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks