Overview

overview

10

Static

static

3

JaffaCakes...b3.exe

windows7-x64

10

JaffaCakes...b3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_d9096459ada8d5a3016994f93248f6b3

  • Size

    313KB

  • Sample

    250120-crcsvawpax

  • MD5

    d9096459ada8d5a3016994f93248f6b3

  • SHA1

    6a5c3c1cfe689c40567d67978e15b7662009460c

  • SHA256

    124770e340bc72a713bb11af0d325e312616bb2ef441dedf70baed7ecf7e631f

  • SHA512

    041d4efba8a4b541a073109f455ebcd699b39845615758b0b6c5952bc4f0d478671f2471156d484ad6b5c9e3f610f29d2f06ac23edf186cb00fc230c83e4964c

  • SSDEEP

    6144:cWJlPF24MowtAMaC0ZybwjHBFZFn99lHALF6yBI0DpQnBmI85NBg:/lPF2XoGxaCqZFlgLF7dDpyBmI8vBg

Score
10/10
xtremeratdiscoverypersistenceratspyware

Malware Config

Targets

    • Target

      JaffaCakes118_d9096459ada8d5a3016994f93248f6b3

    • Size

      313KB

    • MD5

      d9096459ada8d5a3016994f93248f6b3

    • SHA1

      6a5c3c1cfe689c40567d67978e15b7662009460c

    • SHA256

      124770e340bc72a713bb11af0d325e312616bb2ef441dedf70baed7ecf7e631f

    • SHA512

      041d4efba8a4b541a073109f455ebcd699b39845615758b0b6c5952bc4f0d478671f2471156d484ad6b5c9e3f610f29d2f06ac23edf186cb00fc230c83e4964c

    • SSDEEP

      6144:cWJlPF24MowtAMaC0ZybwjHBFZFn99lHALF6yBI0DpQnBmI85NBg:/lPF2XoGxaCqZFlgLF7dDpyBmI8vBg

    Score
    10/10
    xtremeratdiscoverypersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Xtremerat family

      xtremerat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks