Overview

overview

10

Static

static

3

6eaea6b1b1...18.exe

windows7-x64

10

6eaea6b1b1...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6eaea6b1b1dd53d9e9c1e42f01dd85b0_JaffaCakes118

  • Size

    113KB

  • Sample

    241023-nnn79azbnl

  • MD5

    6eaea6b1b1dd53d9e9c1e42f01dd85b0

  • SHA1

    7f639d069e7ac11b99b33bcd5141649d564da2b5

  • SHA256

    1848d3d3684e367419eccecc11b18db2f4f8eb50c3f22215efed95ae3d1f7d9f

  • SHA512

    b2264d9cc04b53120436e9a5347e73484f89ed86a6b7cbe62f7d3d622e556166d414a22a605a36b6ac8d2dcf1e0539497b39b40c072789de8f326108fc0f633c

  • SSDEEP

    1536:iCSp7B0RGwWyuTYGUFwMeAur6vcOAFpRJNF+75DUSvHgMpvP5D9xS3rHBn7:irdq8dEMF+ErFnJkUmAMVRmL17

Score
10/10
xtremeratdiscoverypersistenceratspyware

Malware Config

Targets

    • Target

      6eaea6b1b1dd53d9e9c1e42f01dd85b0_JaffaCakes118

    • Size

      113KB

    • MD5

      6eaea6b1b1dd53d9e9c1e42f01dd85b0

    • SHA1

      7f639d069e7ac11b99b33bcd5141649d564da2b5

    • SHA256

      1848d3d3684e367419eccecc11b18db2f4f8eb50c3f22215efed95ae3d1f7d9f

    • SHA512

      b2264d9cc04b53120436e9a5347e73484f89ed86a6b7cbe62f7d3d622e556166d414a22a605a36b6ac8d2dcf1e0539497b39b40c072789de8f326108fc0f633c

    • SSDEEP

      1536:iCSp7B0RGwWyuTYGUFwMeAur6vcOAFpRJNF+75DUSvHgMpvP5D9xS3rHBn7:irdq8dEMF+ErFnJkUmAMVRmL17

    Score
    10/10
    xtremeratdiscoverypersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks