General

  • Target

    273580811350332eb478498945124106_JaffaCakes118

  • Size

    652KB

  • Sample

    241008-3qnrtstela

  • MD5

    273580811350332eb478498945124106

  • SHA1

    00b0a55534da883b5aa42f99fc8dc66cd8cadeb4

  • SHA256

    7006e461121aa4448ca700960d9648f34142e921841703633670ffb64e730d89

  • SHA512

    76277e2643641640a16f4daa38aee2043f090b57caec1080513cc12cad467b2e61216ac2b4495f79dd400650e862b233b1f57cc7e21e8f517e40329ba5cb8f38

  • SSDEEP

    12288:Hmmo7YNQzGnBaWnBsPDqWOFqetuiaSwXb0lvIfU+5wOAja7:GvwQyBaWnBCqyaaNCM2OAja7

Malware Config

Extracted

Family

xtremerat

C2

hengerfej.no-ip.org

Targets

    • Target

      273580811350332eb478498945124106_JaffaCakes118

    • Size

      652KB

    • MD5

      273580811350332eb478498945124106

    • SHA1

      00b0a55534da883b5aa42f99fc8dc66cd8cadeb4

    • SHA256

      7006e461121aa4448ca700960d9648f34142e921841703633670ffb64e730d89

    • SHA512

      76277e2643641640a16f4daa38aee2043f090b57caec1080513cc12cad467b2e61216ac2b4495f79dd400650e862b233b1f57cc7e21e8f517e40329ba5cb8f38

    • SSDEEP

      12288:Hmmo7YNQzGnBaWnBsPDqWOFqetuiaSwXb0lvIfU+5wOAja7:GvwQyBaWnBCqyaaNCM2OAja7

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks