Overview

overview

10

Static

static

3

32702af377...18.exe

windows7-x64

10

32702af377...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    32702af377f6ee302cb82abf05bcc4bd_JaffaCakes118

  • Size

    300KB

  • Sample

    241011-ajzljavbla

  • MD5

    32702af377f6ee302cb82abf05bcc4bd

  • SHA1

    44d30da7c4cdf8d9a4b5685f0a2803d972a017d9

  • SHA256

    bd3bbce19f1db201fd0e6b7cd794c4dc349bd66940e3af97344887a7b3fdcf26

  • SHA512

    3f60c3ad35a13b2a0579cc73fae2a935ce4af51807b04d3346a8ac18f43d46c63742103e8db0ef0b518609885ba0c75d0fd3ad019f1bef39d645045b50304c3b

  • SSDEEP

    3072:c6kPUft0V8epCMEjMzo+vUik0CWYWwX+jBqUze588jMNEN14+E3vfVe/+l:psUftunpKm5IW7TMppz4Dvfw

Score
10/10
xtremeratdiscoverypersistenceratspywareupx

Malware Config

Targets

    • Target

      32702af377f6ee302cb82abf05bcc4bd_JaffaCakes118

    • Size

      300KB

    • MD5

      32702af377f6ee302cb82abf05bcc4bd

    • SHA1

      44d30da7c4cdf8d9a4b5685f0a2803d972a017d9

    • SHA256

      bd3bbce19f1db201fd0e6b7cd794c4dc349bd66940e3af97344887a7b3fdcf26

    • SHA512

      3f60c3ad35a13b2a0579cc73fae2a935ce4af51807b04d3346a8ac18f43d46c63742103e8db0ef0b518609885ba0c75d0fd3ad019f1bef39d645045b50304c3b

    • SSDEEP

      3072:c6kPUft0V8epCMEjMzo+vUik0CWYWwX+jBqUze588jMNEN14+E3vfVe/+l:psUftunpKm5IW7TMppz4Dvfw

    Score
    10/10
    xtremeratdiscoverypersistenceratspywareupx

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks