Overview

overview

10

Static

static

3

bc8e1da507...18.exe

windows7-x64

10

bc8e1da507...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bc8e1da50706bcb8321e9801e5d0f3b0_JaffaCakes118

  • Size

    256KB

  • Sample

    241203-kfqvbssrek

  • MD5

    bc8e1da50706bcb8321e9801e5d0f3b0

  • SHA1

    d4171182fbc73dada2558a2d01a9217078625c5d

  • SHA256

    e41287f8c0fd9459833ad09d8285bb9a44690fdd172fd9a33b933f50ed21dbff

  • SHA512

    c39cf3d9fd0a5cec9b8649812c8edb948df1d39e2d8edb9fab917da3768b68825066da2bfc86d4a83d7f75353e2b0e886fb94003769d5e6a4e1de559c4b17e38

  • SSDEEP

    6144:332DaBByk9s4hw8JQl5WZl4TyQOI5JgpcvqNplcHsY85BT6V:nKMBMSw8JQpT0Iw5pKhMh2

Score
10/10
xtremeratbootkitdiscoverypersistenceratspyware

Malware Config

Targets

    • Target

      bc8e1da50706bcb8321e9801e5d0f3b0_JaffaCakes118

    • Size

      256KB

    • MD5

      bc8e1da50706bcb8321e9801e5d0f3b0

    • SHA1

      d4171182fbc73dada2558a2d01a9217078625c5d

    • SHA256

      e41287f8c0fd9459833ad09d8285bb9a44690fdd172fd9a33b933f50ed21dbff

    • SHA512

      c39cf3d9fd0a5cec9b8649812c8edb948df1d39e2d8edb9fab917da3768b68825066da2bfc86d4a83d7f75353e2b0e886fb94003769d5e6a4e1de559c4b17e38

    • SSDEEP

      6144:332DaBByk9s4hw8JQl5WZl4TyQOI5JgpcvqNplcHsY85BT6V:nKMBMSw8JQpT0Iw5pKhMh2

    Score
    10/10
    xtremeratbootkitdiscoverypersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Xtremerat family

      xtremerat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Adds Run key to start application

      persistence

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks