General

  • Target

    5cec29c612dc373868cc7a8b0a17f668_JaffaCakes118

  • Size

    290KB

  • Sample

    241019-q185as1cpk

  • MD5

    5cec29c612dc373868cc7a8b0a17f668

  • SHA1

    c1e21311303ee7c94edbf527ede53f09b36061a1

  • SHA256

    ca935715c9f2678ce21f10c22aa56deb63e9135f2b3f734e3f46ac27d1dac2d0

  • SHA512

    f39ea98f4ed54a5e3d170ae81badb99dfe00387e9d8b3141ef8beb16f005cd5aac40204b61b065148ed28a83b73d156c6cb65ec7c73515f1c3e4c7e70f9df06e

  • SSDEEP

    1536:fT8qDqQ8K9MK3tGjbNwPZ6oIeXHWJ0YVytx:LqMyKdcPeXHWCYVyx

Malware Config

Extracted

Family

xtremerat

C2

cwkomando.no-ip.org

Targets

    • Target

      5cec29c612dc373868cc7a8b0a17f668_JaffaCakes118

    • Size

      290KB

    • MD5

      5cec29c612dc373868cc7a8b0a17f668

    • SHA1

      c1e21311303ee7c94edbf527ede53f09b36061a1

    • SHA256

      ca935715c9f2678ce21f10c22aa56deb63e9135f2b3f734e3f46ac27d1dac2d0

    • SHA512

      f39ea98f4ed54a5e3d170ae81badb99dfe00387e9d8b3141ef8beb16f005cd5aac40204b61b065148ed28a83b73d156c6cb65ec7c73515f1c3e4c7e70f9df06e

    • SSDEEP

      1536:fT8qDqQ8K9MK3tGjbNwPZ6oIeXHWJ0YVytx:LqMyKdcPeXHWCYVyx

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks