Overview

overview

10

Static

static

3

JaffaCakes...4c.exe

windows7-x64

10

JaffaCakes...4c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_c52b3eb7c4deace3e9f4a2b6fd10b94c

  • Size

    360KB

  • Sample

    250119-mjvc2avkfl

  • MD5

    c52b3eb7c4deace3e9f4a2b6fd10b94c

  • SHA1

    7a1049daa3802d5c4542afbd05b8416fa452b07d

  • SHA256

    145fe519a5106116ae376d1041129b810b187eb687ae36b51e3689f1be5cc91d

  • SHA512

    99c9c6cab115ff3fc285c531a5c7abed3af3fc3f15e36f0f65f42ad9c4f8a8953478252bd1343214e3ecd3d869791bd5dc99538ca9489cd67a5051dfcd040034

  • SSDEEP

    6144:/NupFANOAKYkTzlGz9gOUb2GBqoOkR6loMnKXAO0Bu5UAb9Fs5c2yApxP34872G8:FYANvK/lGRgOUqmq9kR6lhKX+B3a9FsQ

Score
10/10
xtremeratdiscoverypersistenceratspyware

Malware Config

Targets

    • Target

      JaffaCakes118_c52b3eb7c4deace3e9f4a2b6fd10b94c

    • Size

      360KB

    • MD5

      c52b3eb7c4deace3e9f4a2b6fd10b94c

    • SHA1

      7a1049daa3802d5c4542afbd05b8416fa452b07d

    • SHA256

      145fe519a5106116ae376d1041129b810b187eb687ae36b51e3689f1be5cc91d

    • SHA512

      99c9c6cab115ff3fc285c531a5c7abed3af3fc3f15e36f0f65f42ad9c4f8a8953478252bd1343214e3ecd3d869791bd5dc99538ca9489cd67a5051dfcd040034

    • SSDEEP

      6144:/NupFANOAKYkTzlGz9gOUb2GBqoOkR6loMnKXAO0Bu5UAb9Fs5c2yApxP34872G8:FYANvK/lGRgOUqmq9kR6lhKX+B3a9FsQ

    Score
    10/10
    xtremeratdiscoverypersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Xtremerat family

      xtremerat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks