Overview

overview

10

Static

static

3

JaffaCakes...fe.exe

windows7-x64

10

JaffaCakes...fe.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_c579c77aab7d55003e16ee77d8e871fe

  • Size

    180KB

  • Sample

    250109-l5drqsypgp

  • MD5

    c579c77aab7d55003e16ee77d8e871fe

  • SHA1

    6766fa883b36c3fbe4237de3fcd35984f8043681

  • SHA256

    5de00dd1a531be0249d174d5542dac457d4019b5163ea64d18d116e2750327e1

  • SHA512

    ad6964673900df48a8c2599517324553fcf04d4b9ba605eb452c648a193780b6dc72720740b4c46d3311d85835f7c6fa823f79587f5903e9b237cf705a7b85ea

  • SSDEEP

    3072:wW/p7H3PfZmVgu6madOO7vl3JosedK3zBnHc:wW/p7XpaF61sO7NZoseQ3lH

Score
10/10
xtremeratdiscoverypersistenceratspywareupx

Malware Config

Targets

    • Target

      JaffaCakes118_c579c77aab7d55003e16ee77d8e871fe

    • Size

      180KB

    • MD5

      c579c77aab7d55003e16ee77d8e871fe

    • SHA1

      6766fa883b36c3fbe4237de3fcd35984f8043681

    • SHA256

      5de00dd1a531be0249d174d5542dac457d4019b5163ea64d18d116e2750327e1

    • SHA512

      ad6964673900df48a8c2599517324553fcf04d4b9ba605eb452c648a193780b6dc72720740b4c46d3311d85835f7c6fa823f79587f5903e9b237cf705a7b85ea

    • SSDEEP

      3072:wW/p7H3PfZmVgu6madOO7vl3JosedK3zBnHc:wW/p7XpaF61sO7NZoseQ3lH

    Score
    10/10
    xtremeratdiscoverypersistenceratspywareupx

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Xtremerat family

      xtremerat

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks