Overview

overview

10

Static

static

10

4a99ccc162...18.exe

windows7-x64

10

4a99ccc162...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4a99ccc1621bb29fc6d21e9e0c2b9f8e_JaffaCakes118

  • Size

    45KB

  • Sample

    241020-zfpdts1bmk

  • MD5

    4a99ccc1621bb29fc6d21e9e0c2b9f8e

  • SHA1

    cfd4083039fbb6cefa32efbe1e6825ee19e2484a

  • SHA256

    cfed81dd43d3deaeab150fd6d08320b24b5b3c1fcfe35c6a6bbbfd2dd15d9791

  • SHA512

    88e6592bfc33b46716751da1cb3e65ade03da5f73d3d29bca44c8356ffb118609aa0e9dc293ef61288f98dec028c7d9e743ffa78f5f2809b75219287d209e2df

  • SSDEEP

    768:9Br+tjFY90iY6W1jwmDzKgEFQXaklMIAnH8hwfOgw0cezoZzJ:jyRh31jxPEFQXak+H84bnoZzJ

Score
10/10
xtremeratdiscoverypersistenceratspyware

Malware Config

Targets

    • Target

      4a99ccc1621bb29fc6d21e9e0c2b9f8e_JaffaCakes118

    • Size

      45KB

    • MD5

      4a99ccc1621bb29fc6d21e9e0c2b9f8e

    • SHA1

      cfd4083039fbb6cefa32efbe1e6825ee19e2484a

    • SHA256

      cfed81dd43d3deaeab150fd6d08320b24b5b3c1fcfe35c6a6bbbfd2dd15d9791

    • SHA512

      88e6592bfc33b46716751da1cb3e65ade03da5f73d3d29bca44c8356ffb118609aa0e9dc293ef61288f98dec028c7d9e743ffa78f5f2809b75219287d209e2df

    • SSDEEP

      768:9Br+tjFY90iY6W1jwmDzKgEFQXaklMIAnH8hwfOgw0cezoZzJ:jyRh31jxPEFQXak+H84bnoZzJ

    Score
    10/10
    xtremeratdiscoverypersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks