General

  • Target

    fe5b2876beba86b58c532a6b624075c9_JaffaCakes118

  • Size

    65KB

  • Sample

    241219-elfcwsxqhl

  • MD5

    fe5b2876beba86b58c532a6b624075c9

  • SHA1

    d5fa2931c3dbc1f1a65c52602db77db9f810ab33

  • SHA256

    a5a9c7c161cdcb7ebdb6462649697dad9d2bed09b1f64b357188f55c92a836b7

  • SHA512

    2d64884738acc8766486e7cb9156a9c2dd6d0abd55969aa1ffa689e935e7005d3bbead7f21f8d60784cd491c5bf388b990873b4c0873c50a365fd4897969da14

  • SSDEEP

    768:d9m1Sq4NQkrBsH1kJz0wDeeQuMVTyN8ipHos7Vmd6AeXVtWAJ7A+7voNweS+gp:asq+Q1iZQuIyJpLmgA+FJ0LNwV

Malware Config

Extracted

Family

xtremerat

C2

kingprog.no-ip.info

Targets

    • Target

      fe5b2876beba86b58c532a6b624075c9_JaffaCakes118

    • Size

      65KB

    • MD5

      fe5b2876beba86b58c532a6b624075c9

    • SHA1

      d5fa2931c3dbc1f1a65c52602db77db9f810ab33

    • SHA256

      a5a9c7c161cdcb7ebdb6462649697dad9d2bed09b1f64b357188f55c92a836b7

    • SHA512

      2d64884738acc8766486e7cb9156a9c2dd6d0abd55969aa1ffa689e935e7005d3bbead7f21f8d60784cd491c5bf388b990873b4c0873c50a365fd4897969da14

    • SSDEEP

      768:d9m1Sq4NQkrBsH1kJz0wDeeQuMVTyN8ipHos7Vmd6AeXVtWAJ7A+7voNweS+gp:asq+Q1iZQuIyJpLmgA+FJ0LNwV

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    • Xtremerat family

MITRE ATT&CK Enterprise v15

Tasks