Overview

overview

10

Static

static

3

JaffaCakes...80.exe

windows7-x64

10

JaffaCakes...80.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_621ed4c8140878ffd44ab132c48b8680

  • Size

    60KB

  • Sample

    250102-czyqaa1lgr

  • MD5

    621ed4c8140878ffd44ab132c48b8680

  • SHA1

    7308e3ff07a709f9c5a6e3ec59c86c37257ac7e4

  • SHA256

    b6f740f4893c82b5c5140e46a085ca0aadb5ff33031657401bb5ec476be4a0cd

  • SHA512

    5a506a4c45dcc1ee36edb41ee5dfc08a2988d4116bea3ec73a0d521642d6a0a60d8590fd59b9119449cf6a6287eae07e74b9ff70e37d10bc1a3be78325ad840f

  • SSDEEP

    768:9QLpmV2YAYnzJX0T79TnYQVH7CEnkjI8Yy9eke7plJdxnYn0DvJgRcOW8wq2Zo:9QLi1AozJXIJYu6IPplJdxYLQ8whZo

Score
10/10
xtremeratdiscoverypersistenceratspyware

Malware Config

Targets

    • Target

      JaffaCakes118_621ed4c8140878ffd44ab132c48b8680

    • Size

      60KB

    • MD5

      621ed4c8140878ffd44ab132c48b8680

    • SHA1

      7308e3ff07a709f9c5a6e3ec59c86c37257ac7e4

    • SHA256

      b6f740f4893c82b5c5140e46a085ca0aadb5ff33031657401bb5ec476be4a0cd

    • SHA512

      5a506a4c45dcc1ee36edb41ee5dfc08a2988d4116bea3ec73a0d521642d6a0a60d8590fd59b9119449cf6a6287eae07e74b9ff70e37d10bc1a3be78325ad840f

    • SSDEEP

      768:9QLpmV2YAYnzJX0T79TnYQVH7CEnkjI8Yy9eke7plJdxnYn0DvJgRcOW8wq2Zo:9QLi1AozJXIJYu6IPplJdxYLQ8whZo

    Score
    10/10
    xtremeratdiscoverypersistenceratspyware

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Xtremerat family

      xtremerat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks