Overview

overview

10

Static

static

3

cbd580a72e...18.exe

windows7-x64

10

cbd580a72e...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cbd580a72e33066ca1b613a1119af858_JaffaCakes118

  • Size

    64KB

  • Sample

    240830-21efga1hqr

  • MD5

    cbd580a72e33066ca1b613a1119af858

  • SHA1

    489de2a877ba995ba485bd07d7f1a1675ed4b6ba

  • SHA256

    890de4cd634dcbcbc2f58362d9ad8d6cdc79ad14026fa9584383a2ae82ec3410

  • SHA512

    8228684a72ff9226a54ce1012241b3e6da7bcf15b0d89f6775f4a7a91571a81c218582f7ef71b22fa8839fa04d678ce3b1130ed2d372c30da7ecd24e81bf4a29

  • SSDEEP

    1536:cEUQjlDAMOcnNFCEcK3gGrvCv7OqcjoG:cVulMMlXE+g4Y7go

Score
10/10
hawkeyextremeratdiscoverykeyloggerpersistenceratspywarestealertrojanupx

Malware Config

Targets

    • Target

      cbd580a72e33066ca1b613a1119af858_JaffaCakes118

    • Size

      64KB

    • MD5

      cbd580a72e33066ca1b613a1119af858

    • SHA1

      489de2a877ba995ba485bd07d7f1a1675ed4b6ba

    • SHA256

      890de4cd634dcbcbc2f58362d9ad8d6cdc79ad14026fa9584383a2ae82ec3410

    • SHA512

      8228684a72ff9226a54ce1012241b3e6da7bcf15b0d89f6775f4a7a91571a81c218582f7ef71b22fa8839fa04d678ce3b1130ed2d372c30da7ecd24e81bf4a29

    • SSDEEP

      1536:cEUQjlDAMOcnNFCEcK3gGrvCv7OqcjoG:cVulMMlXE+g4Y7go

    Score
    10/10
    hawkeyextremeratdiscoverykeyloggerpersistenceratspywarestealertrojanupx

    • Detect XtremeRAT payload

    • HawkEye

      HawkEye is a malware kit that has seen continuous development since at least 2013.

      keyloggertrojanstealerspywarehawkeye

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks