Overview

overview

10

Static

static

3

b7a9b374c0...18.exe

windows7-x64

10

b7a9b374c0...18.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    b7a9b374c0668eb956b6f4d48334d7fc_JaffaCakes118

  • Size

    52KB

  • Sample

    240822-ps8ywsxcnf

  • MD5

    b7a9b374c0668eb956b6f4d48334d7fc

  • SHA1

    1787347f22cd25838f663ded0fb03f95b413d102

  • SHA256

    18f9f7cd091b2f0cbc1b1e88e5839381b30520ec6286443752ac91704b1ad708

  • SHA512

    6ae953f7db33c60f386001a57d5767f182eab2a8f65aa022f0e3a8ac07b4261e0d6836dada68bfac98b59d898092639d0f34ec73c0fd6cbbe0d655247e7c814a

  • SSDEEP

    768:/ZMuijtHf5g7/IIG3bGcYDBSvFIWuePQtv66lzotz7eoxN3iAK2f:/SNW71rcYDAWeotvXlKRf

Score
10/10
xtremeratdefense_evasiondiscoverypersistenceratspywareupx

Malware Config

Targets

    • Target

      b7a9b374c0668eb956b6f4d48334d7fc_JaffaCakes118

    • Size

      52KB

    • MD5

      b7a9b374c0668eb956b6f4d48334d7fc

    • SHA1

      1787347f22cd25838f663ded0fb03f95b413d102

    • SHA256

      18f9f7cd091b2f0cbc1b1e88e5839381b30520ec6286443752ac91704b1ad708

    • SHA512

      6ae953f7db33c60f386001a57d5767f182eab2a8f65aa022f0e3a8ac07b4261e0d6836dada68bfac98b59d898092639d0f34ec73c0fd6cbbe0d655247e7c814a

    • SSDEEP

      768:/ZMuijtHf5g7/IIG3bGcYDBSvFIWuePQtv66lzotz7eoxN3iAK2f:/SNW71rcYDAWeotvXlKRf

    Score
    10/10
    xtremeratdiscoverypersistenceratspywareupxdefense_evasion

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks