General
-
Target
31ab9fed0b7551a2e91f95d8f7d4b925_JaffaCakes118
-
Size
1.2MB
-
Sample
241010-y4k6mszgnp
-
MD5
31ab9fed0b7551a2e91f95d8f7d4b925
-
SHA1
a7def0e837394cd9fddc20d40569bb3fba5c2cfb
-
SHA256
f550c579402acc3120b8e7d44e76058c26f8304561a25949d5197d245e72e41f
-
SHA512
4e8e838e0924c85f2d827bee28206e323ff637e194e6d982714e24adda1e28fdc2fd123cac5f02dcc143fba088410dda26d7ecf91a7e35f415d0fc1f3cd11404
-
SSDEEP
24576:XthEVaPqLSxpqb7fAFHp/zkqokrne4E2Bfg/n0b24CYDtVgaVkQY6:bEVUc0pqoLkune4E2Bga24CYDDJSY
Behavioral task
behavioral1
Sample
31ab9fed0b7551a2e91f95d8f7d4b925_JaffaCakes118.exe
Resource
win7-20241010-en
Malware Config
Targets
-
-
Target
31ab9fed0b7551a2e91f95d8f7d4b925_JaffaCakes118
-
Size
1.2MB
-
MD5
31ab9fed0b7551a2e91f95d8f7d4b925
-
SHA1
a7def0e837394cd9fddc20d40569bb3fba5c2cfb
-
SHA256
f550c579402acc3120b8e7d44e76058c26f8304561a25949d5197d245e72e41f
-
SHA512
4e8e838e0924c85f2d827bee28206e323ff637e194e6d982714e24adda1e28fdc2fd123cac5f02dcc143fba088410dda26d7ecf91a7e35f415d0fc1f3cd11404
-
SSDEEP
24576:XthEVaPqLSxpqb7fAFHp/zkqokrne4E2Bfg/n0b24CYDtVgaVkQY6:bEVUc0pqoLkune4E2Bga24CYDDJSY
-
Detect XtremeRAT payload
-
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Executes dropped EXE
-
Loads dropped DLL
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext
-