Overview

overview

10

Static

static

3

fdd35659b7...18.exe

windows7-x64

10

fdd35659b7...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fdd35659b7ca2e9e62adaba2f4b222ed_JaffaCakes118

  • Size

    64KB

  • Sample

    241219-bf16ma1kfm

  • MD5

    fdd35659b7ca2e9e62adaba2f4b222ed

  • SHA1

    91c0ee04caf1d74d4aaf6f65752376b39ac060dd

  • SHA256

    0e3d1e8feed80ebdf7f88c897914d45d9ac6aa02924dd5281f1dd4fdcbc18f8c

  • SHA512

    e973181fc7c4ffdcb0d06d556796e73dd6c6c61e82cb190a9a6d385cc7c948b941e127e452d2ed64baf465e356f344248488a7e0d8fd5eda02f4013dcf9ec8a4

  • SSDEEP

    1536:PLCQ0OqJkdhcjHFv9FlF9BFfYRKYqgnqZy:PLCx4cjHL/F9BRqKY5nX

Score
10/10
xtremeratdiscoverypersistenceratspywareupx

Malware Config

Targets

    • Target

      fdd35659b7ca2e9e62adaba2f4b222ed_JaffaCakes118

    • Size

      64KB

    • MD5

      fdd35659b7ca2e9e62adaba2f4b222ed

    • SHA1

      91c0ee04caf1d74d4aaf6f65752376b39ac060dd

    • SHA256

      0e3d1e8feed80ebdf7f88c897914d45d9ac6aa02924dd5281f1dd4fdcbc18f8c

    • SHA512

      e973181fc7c4ffdcb0d06d556796e73dd6c6c61e82cb190a9a6d385cc7c948b941e127e452d2ed64baf465e356f344248488a7e0d8fd5eda02f4013dcf9ec8a4

    • SSDEEP

      1536:PLCQ0OqJkdhcjHFv9FlF9BFfYRKYqgnqZy:PLCx4cjHL/F9BRqKY5nX

    Score
    10/10
    xtremeratdiscoverypersistenceratspywareupx

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Xtremerat family

      xtremerat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks