General

  • Target

    30575afe25275088e7922ca100661737_JaffaCakes118

  • Size

    50KB

  • Sample

    241010-rsqhnazerh

  • MD5

    30575afe25275088e7922ca100661737

  • SHA1

    a34bf51d5b7352240fd0305010624ff2fdff79ff

  • SHA256

    72f2004c5d12feb5c0b0748b6e3be3b834bd9b8922ec0549cc5f29e31121b01f

  • SHA512

    0eec9d98eb15c4cf1b2847a72f75264478f1b3549a03b11f8cdee80dc516d301d2b12576da282a85800032b55288a61bfcbd4dd5aafae63a3a41bc081f58be3e

  • SSDEEP

    1536:VVKr3uOrO1U4iU1Ilmt24+1+6GPJPv4rhwh:V8rHrOdiXClOfGhPv4i

Malware Config

Extracted

Family

xtremerat

C2

eminem30.no-ip.org

Targets

    • Target

      30575afe25275088e7922ca100661737_JaffaCakes118

    • Size

      50KB

    • MD5

      30575afe25275088e7922ca100661737

    • SHA1

      a34bf51d5b7352240fd0305010624ff2fdff79ff

    • SHA256

      72f2004c5d12feb5c0b0748b6e3be3b834bd9b8922ec0549cc5f29e31121b01f

    • SHA512

      0eec9d98eb15c4cf1b2847a72f75264478f1b3549a03b11f8cdee80dc516d301d2b12576da282a85800032b55288a61bfcbd4dd5aafae63a3a41bc081f58be3e

    • SSDEEP

      1536:VVKr3uOrO1U4iU1Ilmt24+1+6GPJPv4rhwh:V8rHrOdiXClOfGhPv4i

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks