Overview

overview

10

Static

static

3

e836cd29fd...18.exe

windows7-x64

10

e836cd29fd...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e836cd29fd4f6e3a0f6d9ad859f9b64f_JaffaCakes118

  • Size

    86KB

  • Sample

    241212-zlc8raypgk

  • MD5

    e836cd29fd4f6e3a0f6d9ad859f9b64f

  • SHA1

    6e747d5ce2f414e898dc2a767b34de41aeb60b27

  • SHA256

    c470b81aa632fe7b9fb4a4d04c5c800d3bab9eca195f70ffed1affc9dc6aea6c

  • SHA512

    e497293ec873c1a281e810e5d9f2afb30453a2358f281b9e16e8612c376633daf8a492c6535c923558667462c06084801a4951460275b52b7ea457bcfef679bf

  • SSDEEP

    1536:ERaaXjRUtqgI8au7MkRW5dWtQvVAnrIhj/R6hl+Lv:EkaXef7hRsWCtAnrIF/RowL

Score
10/10
xtremeratdiscoverypersistenceratspyware

Malware Config

Targets

    • Target

      e836cd29fd4f6e3a0f6d9ad859f9b64f_JaffaCakes118

    • Size

      86KB

    • MD5

      e836cd29fd4f6e3a0f6d9ad859f9b64f

    • SHA1

      6e747d5ce2f414e898dc2a767b34de41aeb60b27

    • SHA256

      c470b81aa632fe7b9fb4a4d04c5c800d3bab9eca195f70ffed1affc9dc6aea6c

    • SHA512

      e497293ec873c1a281e810e5d9f2afb30453a2358f281b9e16e8612c376633daf8a492c6535c923558667462c06084801a4951460275b52b7ea457bcfef679bf

    • SSDEEP

      1536:ERaaXjRUtqgI8au7MkRW5dWtQvVAnrIhj/R6hl+Lv:EkaXef7hRsWCtAnrIF/RowL

    Score
    10/10
    xtremeratdiscoverypersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Xtremerat family

      xtremerat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks