Behavioral task
behavioral1
Sample
b8c592440dc028aa2523352277d673a5_JaffaCakes118.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
b8c592440dc028aa2523352277d673a5_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
b8c592440dc028aa2523352277d673a5_JaffaCakes118
-
Size
438KB
-
MD5
b8c592440dc028aa2523352277d673a5
-
SHA1
672373b2cb8bab398715f50c2615821ebd0ec444
-
SHA256
6804f6f2353866ce9c725ef6acbfd0a2ca87a2605e98a6a1d61c01933a45a343
-
SHA512
6bab1ad60fb7ca0ea634f5b152bca1d579185171ba4cdc7ad73ae7d233a1ec6c35d2a1255df6202250448b0dd00c972b0070c76e63666c9dc8633f00e6284775
-
SSDEEP
6144:YcnIURcIBZEjlCBHPc4pctFisXdTnJELVt1goIbutYUQfLCIHic/mbn4A00FPvGo:r/8jQHPsLnGVt1gpU+eWOnlpVvuSkBo
Malware Config
Signatures
-
Detect XtremeRAT payload 1 IoCs
resource yara_rule sample family_xtremerat -
Xtremerat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource b8c592440dc028aa2523352277d673a5_JaffaCakes118
Files
-
b8c592440dc028aa2523352277d673a5_JaffaCakes118.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 30KB - Virtual size: 30KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
DATA Size: 512B - Virtual size: 232B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 9KB
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 8B
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 399KB - Virtual size: 399KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ