Overview

overview

10

Static

static

3

JaffaCakes...90.exe

windows7-x64

10

JaffaCakes...90.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_69f2b441f714611e886c9f2d267ff090

  • Size

    44KB

  • Sample

    250116-ea5tea1qfq

  • MD5

    69f2b441f714611e886c9f2d267ff090

  • SHA1

    86da4233c1fe3371610fee302a9365b5ffb3aed1

  • SHA256

    2572e1ffe6cac4081c5920b29889bdd54aaf38c85aa3f9646649196f3eb96f32

  • SHA512

    d0eb8736db0cc83be1d318019b9b19de7f2fc02db973b89f606368e981a4d6c4ec2e1f8b9a75fcf5c76f24668c9c3331e19d63c6881ffc14d31569bf35144d43

  • SSDEEP

    768:s+T6GAnXMEW5Xo/reDspcxzXmIWJTq66WPyEi9C3CV6JnU/jNaVINAq3LmN0iDnh:s+HAn8TkeECBUviOCVwmjUINAq3VA

Score
10/10
xtremeratdiscoverypersistenceratspywareupx

Malware Config

Targets

    • Target

      JaffaCakes118_69f2b441f714611e886c9f2d267ff090

    • Size

      44KB

    • MD5

      69f2b441f714611e886c9f2d267ff090

    • SHA1

      86da4233c1fe3371610fee302a9365b5ffb3aed1

    • SHA256

      2572e1ffe6cac4081c5920b29889bdd54aaf38c85aa3f9646649196f3eb96f32

    • SHA512

      d0eb8736db0cc83be1d318019b9b19de7f2fc02db973b89f606368e981a4d6c4ec2e1f8b9a75fcf5c76f24668c9c3331e19d63c6881ffc14d31569bf35144d43

    • SSDEEP

      768:s+T6GAnXMEW5Xo/reDspcxzXmIWJTq66WPyEi9C3CV6JnU/jNaVINAq3LmN0iDnh:s+HAn8TkeECBUviOCVwmjUINAq3VA

    Score
    10/10
    xtremeratdiscoverypersistenceratspywareupx

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Xtremerat family

      xtremerat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks