Overview

overview

10

Static

static

3

eac5664cd2...18.exe

windows7-x64

10

eac5664cd2...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eac5664cd2fab25f97ff77d9a3f597a3_JaffaCakes118

  • Size

    116KB

  • Sample

    240919-hcza7avgjf

  • MD5

    eac5664cd2fab25f97ff77d9a3f597a3

  • SHA1

    2fbe76bfa925e9cf6151a0fe31b584aad753a87c

  • SHA256

    a195a91bc1f3f15aee140fd45961a67f761f0fe245664a0365ccf6f2a3fc20cf

  • SHA512

    0a6209af7268b5a1675ca34b9d30748b2a6ea77d65b57a9189aa938b466adcdf89eac62ca4d2aa613e9d469b3a083ec6a226533b438fd43023086574b7cf8c45

  • SSDEEP

    1536:hq4tkkJk77IZ+PBHsX4E3jPRC3h6WdBr1OmqgQO3It2rPzVamqQ2:g4tkkJG7IZ+P5sH3V0UWdtwVPUy2jm

Score
10/10
xtremeratdiscoverypersistenceratspyware

Malware Config

Targets

    • Target

      eac5664cd2fab25f97ff77d9a3f597a3_JaffaCakes118

    • Size

      116KB

    • MD5

      eac5664cd2fab25f97ff77d9a3f597a3

    • SHA1

      2fbe76bfa925e9cf6151a0fe31b584aad753a87c

    • SHA256

      a195a91bc1f3f15aee140fd45961a67f761f0fe245664a0365ccf6f2a3fc20cf

    • SHA512

      0a6209af7268b5a1675ca34b9d30748b2a6ea77d65b57a9189aa938b466adcdf89eac62ca4d2aa613e9d469b3a083ec6a226533b438fd43023086574b7cf8c45

    • SSDEEP

      1536:hq4tkkJk77IZ+PBHsX4E3jPRC3h6WdBr1OmqgQO3It2rPzVamqQ2:g4tkkJG7IZ+P5sH3V0UWdtwVPUy2jm

    Score
    10/10
    xtremeratdiscoverypersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks