General
-
Target
30575afe25275088e7922ca100661737_JaffaCakes118
-
Size
50KB
-
Sample
241010-rsqhnazerh
-
MD5
30575afe25275088e7922ca100661737
-
SHA1
a34bf51d5b7352240fd0305010624ff2fdff79ff
-
SHA256
72f2004c5d12feb5c0b0748b6e3be3b834bd9b8922ec0549cc5f29e31121b01f
-
SHA512
0eec9d98eb15c4cf1b2847a72f75264478f1b3549a03b11f8cdee80dc516d301d2b12576da282a85800032b55288a61bfcbd4dd5aafae63a3a41bc081f58be3e
-
SSDEEP
1536:VVKr3uOrO1U4iU1Ilmt24+1+6GPJPv4rhwh:V8rHrOdiXClOfGhPv4i
Behavioral task
behavioral1
Sample
30575afe25275088e7922ca100661737_JaffaCakes118.exe
Resource
win7-20241010-en
Malware Config
Extracted
xtremerat
eminem30.no-ip.org
Targets
-
-
Target
30575afe25275088e7922ca100661737_JaffaCakes118
-
Size
50KB
-
MD5
30575afe25275088e7922ca100661737
-
SHA1
a34bf51d5b7352240fd0305010624ff2fdff79ff
-
SHA256
72f2004c5d12feb5c0b0748b6e3be3b834bd9b8922ec0549cc5f29e31121b01f
-
SHA512
0eec9d98eb15c4cf1b2847a72f75264478f1b3549a03b11f8cdee80dc516d301d2b12576da282a85800032b55288a61bfcbd4dd5aafae63a3a41bc081f58be3e
-
SSDEEP
1536:VVKr3uOrO1U4iU1Ilmt24+1+6GPJPv4rhwh:V8rHrOdiXClOfGhPv4i
-
Detect XtremeRAT payload
-
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Suspicious use of SetThreadContext
-