Overview

overview

10

Static

static

3

526468e0b3...18.exe

windows7-x64

10

526468e0b3...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    526468e0b3668b1630ab5cb4ede43a38_JaffaCakes118

  • Size

    176KB

  • Sample

    241017-r3gnha1fqa

  • MD5

    526468e0b3668b1630ab5cb4ede43a38

  • SHA1

    53edf74074ebd98e2cd831c94cedc3fc6970a364

  • SHA256

    bec5c782cdb85aa065113a474a0a9b7e6eed4ea616852a20d5cbc899f5ce8dd0

  • SHA512

    5a8008481df46967ea4b79cd2d48fcfef25bbd1eff85056b9b55fa5b024d03e7b7c944f030d5cccb834e5393826c05affa380818505582e96149943fe61e40af

  • SSDEEP

    3072:DMsG2Xc+88LsQCTqVhn8eRY6DiZp6tQ/azLJayik8xrS9J7l8sxK0sfhroL:I+c+NgQCohn8eR3IbMJaxkd+mEhrM

Score
10/10
xtremeratdiscoverypersistenceratspywareupx

Malware Config

Targets

    • Target

      526468e0b3668b1630ab5cb4ede43a38_JaffaCakes118

    • Size

      176KB

    • MD5

      526468e0b3668b1630ab5cb4ede43a38

    • SHA1

      53edf74074ebd98e2cd831c94cedc3fc6970a364

    • SHA256

      bec5c782cdb85aa065113a474a0a9b7e6eed4ea616852a20d5cbc899f5ce8dd0

    • SHA512

      5a8008481df46967ea4b79cd2d48fcfef25bbd1eff85056b9b55fa5b024d03e7b7c944f030d5cccb834e5393826c05affa380818505582e96149943fe61e40af

    • SSDEEP

      3072:DMsG2Xc+88LsQCTqVhn8eRY6DiZp6tQ/azLJayik8xrS9J7l8sxK0sfhroL:I+c+NgQCohn8eR3IbMJaxkd+mEhrM

    Score
    10/10
    xtremeratdiscoverypersistenceratspywareupx

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks