Overview

overview

10

Static

static

3

6ea2a35802...18.exe

windows7-x64

10

6ea2a35802...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6ea2a3580297d5baac694c6b167fe17c_JaffaCakes118

  • Size

    429KB

  • Sample

    241023-ngn9nsxbng

  • MD5

    6ea2a3580297d5baac694c6b167fe17c

  • SHA1

    4f16288074898bd188a8275420946ad6e62c0923

  • SHA256

    bc6921cc9bc96da8ac65b571ac9af1d33a3f32e259ed141f6b77a999150d9197

  • SHA512

    1b3609ba342e02306e9b26ed99ea19b115b7da0ac4964ec200fabffe32c8a7c57cf41746f2203442ad2a692f5f9b92d78925f2851a0f8ffec2590dd9aacd3c60

  • SSDEEP

    12288:5rOyuP22qsC56K/lGRgOUqmq9kR6lhKXTqySfAow/srAX:VOyY7k6K/cRgOnmq9g6eqySfli

Score
10/10
xtremeratdiscoverypersistenceratspyware

Malware Config

Targets

    • Target

      6ea2a3580297d5baac694c6b167fe17c_JaffaCakes118

    • Size

      429KB

    • MD5

      6ea2a3580297d5baac694c6b167fe17c

    • SHA1

      4f16288074898bd188a8275420946ad6e62c0923

    • SHA256

      bc6921cc9bc96da8ac65b571ac9af1d33a3f32e259ed141f6b77a999150d9197

    • SHA512

      1b3609ba342e02306e9b26ed99ea19b115b7da0ac4964ec200fabffe32c8a7c57cf41746f2203442ad2a692f5f9b92d78925f2851a0f8ffec2590dd9aacd3c60

    • SSDEEP

      12288:5rOyuP22qsC56K/lGRgOUqmq9kR6lhKXTqySfAow/srAX:VOyY7k6K/cRgOnmq9g6eqySfli

    Score
    10/10
    xtremeratdiscoverypersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks