Overview

overview

10

Static

static

3

JaffaCakes...ac.exe

windows7-x64

10

JaffaCakes...ac.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_3113b865f23e361795acb51daf44ddac

  • Size

    508KB

  • Sample

    250113-29cm8sspbj

  • MD5

    3113b865f23e361795acb51daf44ddac

  • SHA1

    3b0d3637e225bbf80e15033867923302793a615b

  • SHA256

    25039852237f70f7bb8c5ec75713d2980aadf547436d1c19469aba5a9a9bf958

  • SHA512

    9f3478fa05877f26b37f83762cc616df44e44ccf46320f9d423e022ac6f5d881968bfa56be97dc7aa862239d86fd7035a9c70e72ae7b6d9f6afd92b51e731a55

  • SSDEEP

    12288:8CxQ069Ow1cs1QKhK/lGRgOUqmq9kR6lhKXmB3a9FsqJKB57d8fWbc:8Cx2X151jhK/cRgOnmq9g6bB36rKX6h

Score
10/10
xtremeratdiscoverypersistenceratspywareupx

Malware Config

Targets

    • Target

      JaffaCakes118_3113b865f23e361795acb51daf44ddac

    • Size

      508KB

    • MD5

      3113b865f23e361795acb51daf44ddac

    • SHA1

      3b0d3637e225bbf80e15033867923302793a615b

    • SHA256

      25039852237f70f7bb8c5ec75713d2980aadf547436d1c19469aba5a9a9bf958

    • SHA512

      9f3478fa05877f26b37f83762cc616df44e44ccf46320f9d423e022ac6f5d881968bfa56be97dc7aa862239d86fd7035a9c70e72ae7b6d9f6afd92b51e731a55

    • SSDEEP

      12288:8CxQ069Ow1cs1QKhK/lGRgOUqmq9kR6lhKXmB3a9FsqJKB57d8fWbc:8Cx2X151jhK/cRgOnmq9g6bB36rKX6h

    Score
    10/10
    xtremeratdiscoverypersistenceratspywareupx

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Xtremerat family

      xtremerat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks