Overview

overview

10

Static

static

10

JaffaCakes...eb.exe

windows7-x64

10

JaffaCakes...eb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_77998898264d408477fa6598d25058eb

  • Size

    158KB

  • Sample

    250104-eytfaa1ndy

  • MD5

    77998898264d408477fa6598d25058eb

  • SHA1

    63c9ee82f4db9f474407da35d6b362a909e6557b

  • SHA256

    9ac7bea93d641666f0c1468355b212f5a91d8a4144fd30c332542a2737b1c1c2

  • SHA512

    439c30e0bf099d1c40dd709ca7ca67f985862cb805147a85cee106087245d7da7d3b98587b9b60d81b8cff8b617c71bd47ba0395f9f122512cb5ec74102ae39d

  • SSDEEP

    1536:Vsq+QV4rObAdXWpfKy/Vz97qjh3rmKPNIoT:M44rjktzojZqMNIoT

Score
10/10
xtremeratdiscoverypersistenceratspyware

Malware Config

Targets

    • Target

      JaffaCakes118_77998898264d408477fa6598d25058eb

    • Size

      158KB

    • MD5

      77998898264d408477fa6598d25058eb

    • SHA1

      63c9ee82f4db9f474407da35d6b362a909e6557b

    • SHA256

      9ac7bea93d641666f0c1468355b212f5a91d8a4144fd30c332542a2737b1c1c2

    • SHA512

      439c30e0bf099d1c40dd709ca7ca67f985862cb805147a85cee106087245d7da7d3b98587b9b60d81b8cff8b617c71bd47ba0395f9f122512cb5ec74102ae39d

    • SSDEEP

      1536:Vsq+QV4rObAdXWpfKy/Vz97qjh3rmKPNIoT:M44rjktzojZqMNIoT

    Score
    10/10
    xtremeratdiscoverypersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Xtremerat family

      xtremerat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks