Overview

overview

10

Static

static

3

3e1d87ed40...18.exe

windows7-x64

10

3e1d87ed40...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3e1d87ed40ee8801075ecc7022bf3c8d_JaffaCakes118

  • Size

    141KB

  • Sample

    241013-gc6jtswcqr

  • MD5

    3e1d87ed40ee8801075ecc7022bf3c8d

  • SHA1

    8ccc114dc67d0a9cd441d64c7826edb0ea84c8ac

  • SHA256

    b45e06c75a16361ee9f4897d5c691724704ebc0afd5611a9aa4eb92dfa4ba2e8

  • SHA512

    53bd3e44445a02cee128ad1bb86a57d0a6d617890a78ed328299c39666681ede15fea103906ac12ae9c1c28651ee877b865fe9e7074c546b4a206682486d13f4

  • SSDEEP

    3072:DmVZ3bRZW2+dzaw0sMJttlUyFlI+e+ANOdfut8Jj:cRDWB5A80I+NfutIj

Score
10/10
xtremeratdiscoverypersistenceratspywareupx

Malware Config

Targets

    • Target

      3e1d87ed40ee8801075ecc7022bf3c8d_JaffaCakes118

    • Size

      141KB

    • MD5

      3e1d87ed40ee8801075ecc7022bf3c8d

    • SHA1

      8ccc114dc67d0a9cd441d64c7826edb0ea84c8ac

    • SHA256

      b45e06c75a16361ee9f4897d5c691724704ebc0afd5611a9aa4eb92dfa4ba2e8

    • SHA512

      53bd3e44445a02cee128ad1bb86a57d0a6d617890a78ed328299c39666681ede15fea103906ac12ae9c1c28651ee877b865fe9e7074c546b4a206682486d13f4

    • SSDEEP

      3072:DmVZ3bRZW2+dzaw0sMJttlUyFlI+e+ANOdfut8Jj:cRDWB5A80I+NfutIj

    Score
    10/10
    xtremeratdiscoverypersistenceratspywareupx

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks