Overview

overview

10

Static

static

10

JaffaCakes...ea.exe

windows7-x64

10

JaffaCakes...ea.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_695f9351453f1e254ee9b554a3b9f6ea

  • Size

    72KB

  • Sample

    250103-brfdastlgy

  • MD5

    695f9351453f1e254ee9b554a3b9f6ea

  • SHA1

    9232438de7d5cfe530676d5f9f6e37cab6ecdcc2

  • SHA256

    1bdd7c476162c7e8b30b575cf0311e7d31ad68596e9998a970d57be43cdd7484

  • SHA512

    dd7a0f51eecd43864c0860dd1240e6954dd4326cb6803cf38d236d06dc4e85e340e9b98039497f46825bc3ddeb6d5f74634448f7a84a0582bd9231fd527a7b1f

  • SSDEEP

    1536:MNW71rcYDAWeotvXluaCFWP9RNmRDXibnOqkSZZZ3rH:MNW7dEvotvXgJUPdmRDSbgUr

Score
10/10
xtremeratdiscoverypersistenceratspywareupx

Malware Config

Extracted

Family

xtremerat

C2

눩缸跼耀ĕ诀൷䆮⮇杦㍦䤄䞰�瘬쓖䲔ຑ⩩눦缸⩃耀Ě暒恭霅竱譀뇒꜀暞婤讐凰䳴鵨눣缸ᙎ耀ğ㪚࠵naffa3.no-ip.biz

Targets

    • Target

      JaffaCakes118_695f9351453f1e254ee9b554a3b9f6ea

    • Size

      72KB

    • MD5

      695f9351453f1e254ee9b554a3b9f6ea

    • SHA1

      9232438de7d5cfe530676d5f9f6e37cab6ecdcc2

    • SHA256

      1bdd7c476162c7e8b30b575cf0311e7d31ad68596e9998a970d57be43cdd7484

    • SHA512

      dd7a0f51eecd43864c0860dd1240e6954dd4326cb6803cf38d236d06dc4e85e340e9b98039497f46825bc3ddeb6d5f74634448f7a84a0582bd9231fd527a7b1f

    • SSDEEP

      1536:MNW71rcYDAWeotvXluaCFWP9RNmRDXibnOqkSZZZ3rH:MNW7dEvotvXgJUPdmRDSbgUr

    Score
    10/10
    xtremeratdiscoverypersistenceratspywareupx

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Xtremerat family

      xtremerat

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks