Overview

overview

10

Static

static

3

af55a8204d...18.exe

windows7-x64

10

af55a8204d...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    af55a8204d380d0cb71903731956ec8e_JaffaCakes118

  • Size

    220KB

  • Sample

    241129-gqyq5svndj

  • MD5

    af55a8204d380d0cb71903731956ec8e

  • SHA1

    fca87c74138cd59d42ffb70853b30d6655d27ce2

  • SHA256

    0eb8a6b7eca4cfce4739d7c3978fe85461c59d9379fa4d69bb5d43414d7df3bc

  • SHA512

    ca8e033cbe56a43dd865d5d03b54a249c9c18a0a5dc474f1e50806ebcc234fce63fa0a2da91dcf5653958c7b638e71a408fdeadeef2533269a1136e4cdd8020c

  • SSDEEP

    6144:vGr5SmlkgbhiIBE93n3xrQd15c3G6zmGQIsPdn:vW5Sm7DE93n3xrI15EzmGQLPdn

Score
10/10
xtremeratdiscoverypersistenceratspyware

Malware Config

Targets

    • Target

      af55a8204d380d0cb71903731956ec8e_JaffaCakes118

    • Size

      220KB

    • MD5

      af55a8204d380d0cb71903731956ec8e

    • SHA1

      fca87c74138cd59d42ffb70853b30d6655d27ce2

    • SHA256

      0eb8a6b7eca4cfce4739d7c3978fe85461c59d9379fa4d69bb5d43414d7df3bc

    • SHA512

      ca8e033cbe56a43dd865d5d03b54a249c9c18a0a5dc474f1e50806ebcc234fce63fa0a2da91dcf5653958c7b638e71a408fdeadeef2533269a1136e4cdd8020c

    • SSDEEP

      6144:vGr5SmlkgbhiIBE93n3xrQd15c3G6zmGQIsPdn:vW5Sm7DE93n3xrI15EzmGQLPdn

    Score
    10/10
    xtremeratdiscoverypersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Xtremerat family

      xtremerat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks