Overview

overview

10

Static

static

3

ccc81326fe...18.exe

windows7-x64

10

ccc81326fe...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ccc81326fe04f6fafeed6feb27538e6f_JaffaCakes118

  • Size

    150KB

  • Sample

    241206-nqyvgavrav

  • MD5

    ccc81326fe04f6fafeed6feb27538e6f

  • SHA1

    15b5e789a8b24a869020085f8253f1645439ae28

  • SHA256

    3945eb0f3cab76c2b4ab04ed15cef673e3441512d71a4130d7354826b73f8e60

  • SHA512

    e6622c68cb84eb61dec146a76118f1129668fe2f6b90ddab6541fad2811b82f7bad5bc1b85dfd250ce0d9312469e369a3527378899e8954d0a73ce23eacc6c5a

  • SSDEEP

    3072:PEPHs79dJt1ipxz9h5nGlFt0myNW7dEvotvXWaK:xVt1ipxxelczNW7mvIu

Score
10/10
xtremeratdiscoverypersistenceratspywareupx

Malware Config

Targets

    • Target

      ccc81326fe04f6fafeed6feb27538e6f_JaffaCakes118

    • Size

      150KB

    • MD5

      ccc81326fe04f6fafeed6feb27538e6f

    • SHA1

      15b5e789a8b24a869020085f8253f1645439ae28

    • SHA256

      3945eb0f3cab76c2b4ab04ed15cef673e3441512d71a4130d7354826b73f8e60

    • SHA512

      e6622c68cb84eb61dec146a76118f1129668fe2f6b90ddab6541fad2811b82f7bad5bc1b85dfd250ce0d9312469e369a3527378899e8954d0a73ce23eacc6c5a

    • SSDEEP

      3072:PEPHs79dJt1ipxz9h5nGlFt0myNW7dEvotvXWaK:xVt1ipxxelczNW7mvIu

    Score
    10/10
    xtremeratdiscoverypersistenceratspywareupx

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Xtremerat family

      xtremerat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks