General

  • Target

    b6e570f765739456ff622ddc2bc69b45_JaffaCakes118

  • Size

    21KB

  • Sample

    241202-fkpevawlar

  • MD5

    b6e570f765739456ff622ddc2bc69b45

  • SHA1

    f4691095a268a61ff2111b2cf329fb792709b086

  • SHA256

    f5b0f527aabb540f41beab0d36a14987dc1cf7f164e0c6b96162dccf28c34ace

  • SHA512

    dd562fd4adad8aa017bac217742c62858668c03b875ad542fd53cd0ca1f849b3835e5b685ea4be8d76dde763c723ee35fab7b7c7b2e6f50aed899eeee0d43563

  • SSDEEP

    384:rUIdmF+Ti213fEF9QZd/cBr5M/gOjkaS4s/1k5YiZNlUpQ4/bQaYhx5pLR:4IsF81fG9QveLOYTe5YiapQQQ9l

Malware Config

Targets

    • Target

      b6e570f765739456ff622ddc2bc69b45_JaffaCakes118

    • Size

      21KB

    • MD5

      b6e570f765739456ff622ddc2bc69b45

    • SHA1

      f4691095a268a61ff2111b2cf329fb792709b086

    • SHA256

      f5b0f527aabb540f41beab0d36a14987dc1cf7f164e0c6b96162dccf28c34ace

    • SHA512

      dd562fd4adad8aa017bac217742c62858668c03b875ad542fd53cd0ca1f849b3835e5b685ea4be8d76dde763c723ee35fab7b7c7b2e6f50aed899eeee0d43563

    • SSDEEP

      384:rUIdmF+Ti213fEF9QZd/cBr5M/gOjkaS4s/1k5YiZNlUpQ4/bQaYhx5pLR:4IsF81fG9QveLOYTe5YiapQQQ9l

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    • Xtremerat family

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.