Overview

overview

10

Static

static

3

a4866ebffb...18.exe

windows7-x64

10

a4866ebffb...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a4866ebffbfcfc26935ab09b684c64d3_JaffaCakes118

  • Size

    916KB

  • Sample

    241126-2r1mcatmdt

  • MD5

    a4866ebffbfcfc26935ab09b684c64d3

  • SHA1

    6cd90939da05c1f2af7c7e7d16c45539afe0b238

  • SHA256

    ad5280eb5e53540933ed7146c19e116be063bafe85ffd6fa21bb1c7174fab123

  • SHA512

    7222a8e46948c20fc269117fd9089beb4a337f3da2a40875884b52e04da3e4008b2fe2134e2dcc94be96d189d23c90cf20e6a81b5e23d53f83dfe47acde9440b

  • SSDEEP

    24576:xxoFQYFyXOSF+FN7InyUkCmXU7JlDEVokXu9RrthXiGl0GbFiI+qVvhPbcflBOnz:xxoFQYFyXOSF+FN7InyUkCmXU7JlDEV/

Score
10/10
xtremeratdiscoverypersistenceratspyware

Malware Config

Targets

    • Target

      a4866ebffbfcfc26935ab09b684c64d3_JaffaCakes118

    • Size

      916KB

    • MD5

      a4866ebffbfcfc26935ab09b684c64d3

    • SHA1

      6cd90939da05c1f2af7c7e7d16c45539afe0b238

    • SHA256

      ad5280eb5e53540933ed7146c19e116be063bafe85ffd6fa21bb1c7174fab123

    • SHA512

      7222a8e46948c20fc269117fd9089beb4a337f3da2a40875884b52e04da3e4008b2fe2134e2dcc94be96d189d23c90cf20e6a81b5e23d53f83dfe47acde9440b

    • SSDEEP

      24576:xxoFQYFyXOSF+FN7InyUkCmXU7JlDEVokXu9RrthXiGl0GbFiI+qVvhPbcflBOnz:xxoFQYFyXOSF+FN7InyUkCmXU7JlDEV/

    Score
    10/10
    xtremeratdiscoverypersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Xtremerat family

      xtremerat

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks