Overview

overview

10

Static

static

3

baa4577807...18.exe

windows7-x64

10

baa4577807...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    baa4577807099d5ef70c602515058c68_JaffaCakes118

  • Size

    118KB

  • Sample

    240823-gt6k6ayfkg

  • MD5

    baa4577807099d5ef70c602515058c68

  • SHA1

    a54569a382890354c833c47ccc211636e3724882

  • SHA256

    149ce45bff7c375cd730b676804c3d25b9c37c4b0f4011a04837a0f0d62f8d43

  • SHA512

    098f826edfb37a5b7ffc9d0010d687f099265ea287de315a5e9a41dff36d9a597550d04042af4991a84efae9c8bc9eb208255d8065bab63e0401c9b003a08abb

  • SSDEEP

    1536:jF1Exu/SqzvEkjRHGaF1v50Aa1rteaVxR76CT13j8E1cQ1CwI510ZaNzizO9Na1v:jFexuznjTzs1BvZx3j/P5S6Za8zIlG

Score
10/10
xtremeratdiscoverypersistenceratspywareupx

Malware Config

Targets

    • Target

      baa4577807099d5ef70c602515058c68_JaffaCakes118

    • Size

      118KB

    • MD5

      baa4577807099d5ef70c602515058c68

    • SHA1

      a54569a382890354c833c47ccc211636e3724882

    • SHA256

      149ce45bff7c375cd730b676804c3d25b9c37c4b0f4011a04837a0f0d62f8d43

    • SHA512

      098f826edfb37a5b7ffc9d0010d687f099265ea287de315a5e9a41dff36d9a597550d04042af4991a84efae9c8bc9eb208255d8065bab63e0401c9b003a08abb

    • SSDEEP

      1536:jF1Exu/SqzvEkjRHGaF1v50Aa1rteaVxR76CT13j8E1cQ1CwI510ZaNzizO9Na1v:jFexuznjTzs1BvZx3j/P5S6Za8zIlG

    Score
    10/10
    xtremeratdiscoverypersistenceratspywareupx

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks