Overview

overview

10

Static

static

3

JaffaCakes...41.exe

windows7-x64

10

JaffaCakes...41.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_b850c270449dc836dac9ec1a9c50f741

  • Size

    269KB

  • Sample

    250119-alpjcazjas

  • MD5

    b850c270449dc836dac9ec1a9c50f741

  • SHA1

    b51b6f9ee580279da20b2b8af976ea34a6e7f089

  • SHA256

    1b43196dcc852208256925ba6545792da9621f114ebbff2d74456656c1fa52c6

  • SHA512

    d34e418e7c2821c35673b1a87e798a5de66908a2bfcbc16ab3d418d47e0869886d867da13ff6bd8e0487bfb6c0891e7b403c0cbd2a8a757f757b0074e42fb593

  • SSDEEP

    6144:js+OHgkZdgu2HV22y96def/mnVW5GJZ2tNYLj8MfsyHZn:pOjfPM22y4lVzYKj86sQ

Score
10/10
xtremeratbootkitdiscoverypersistenceratspywareupx

Malware Config

Targets

    • Target

      JaffaCakes118_b850c270449dc836dac9ec1a9c50f741

    • Size

      269KB

    • MD5

      b850c270449dc836dac9ec1a9c50f741

    • SHA1

      b51b6f9ee580279da20b2b8af976ea34a6e7f089

    • SHA256

      1b43196dcc852208256925ba6545792da9621f114ebbff2d74456656c1fa52c6

    • SHA512

      d34e418e7c2821c35673b1a87e798a5de66908a2bfcbc16ab3d418d47e0869886d867da13ff6bd8e0487bfb6c0891e7b403c0cbd2a8a757f757b0074e42fb593

    • SSDEEP

      6144:js+OHgkZdgu2HV22y96def/mnVW5GJZ2tNYLj8MfsyHZn:pOjfPM22y4lVzYKj86sQ

    Score
    10/10
    xtremeratbootkitdiscoverypersistenceratspywareupx

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Xtremerat family

      xtremerat

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks