Overview

overview

10

Static

static

3

3cf408cac2...18.exe

windows7-x64

10

3cf408cac2...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3cf408cac2dcc3fce3389907877832b6_JaffaCakes118

  • Size

    96KB

  • Sample

    241013-bc7h8svfnk

  • MD5

    3cf408cac2dcc3fce3389907877832b6

  • SHA1

    3cb2303c833e27aad0754027d15cb287b5dc27ac

  • SHA256

    ba259cb832ab8bb7110a6929a073755739b3d36de3f947674270d0b5291f8238

  • SHA512

    91e4ef0b8e7009725812d3b2a1ff503fa1cbf3f312d3b6e59a8c59e8987e6117a726002d83ca3eae0b76a48e90e650f4e383b1f520a7217f9cb8b0a8c9571a35

  • SSDEEP

    1536:MOghaZcYZqJC3xdTNYs9dhoh8SHsNqJH2/X99uwtw9n:MPaZ0JKSs3hPSMNRXN

Score
10/10
xtremeratdiscoverypersistenceratspywareupx

Malware Config

Targets

    • Target

      3cf408cac2dcc3fce3389907877832b6_JaffaCakes118

    • Size

      96KB

    • MD5

      3cf408cac2dcc3fce3389907877832b6

    • SHA1

      3cb2303c833e27aad0754027d15cb287b5dc27ac

    • SHA256

      ba259cb832ab8bb7110a6929a073755739b3d36de3f947674270d0b5291f8238

    • SHA512

      91e4ef0b8e7009725812d3b2a1ff503fa1cbf3f312d3b6e59a8c59e8987e6117a726002d83ca3eae0b76a48e90e650f4e383b1f520a7217f9cb8b0a8c9571a35

    • SSDEEP

      1536:MOghaZcYZqJC3xdTNYs9dhoh8SHsNqJH2/X99uwtw9n:MPaZ0JKSs3hPSMNRXN

    Score
    10/10
    xtremeratdiscoverypersistenceratspywareupx

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks