General

  • Target

    JaffaCakes118_0be3153bc7b02e4d8fffdf6d77f01c54

  • Size

    77KB

  • Sample

    250122-j8qjlaxndm

  • MD5

    0be3153bc7b02e4d8fffdf6d77f01c54

  • SHA1

    4c29ec546f2f783a04f079c89dd0dbecc6a0b304

  • SHA256

    891b6f5e7137fc34a674e8515bae5f5b95dbb33caaf7dfc73b3360021d3a0e05

  • SHA512

    c7eddd593613d915bf55247cfd3d9395558efd12a259988eadf306fa647b63a9757abaa7d24f4d9efd6d6e595912fa50dfcb88b86e66bf2b47401483e83abcfc

  • SSDEEP

    1536:9sq+QV4rObAdkoAf8UqiY/lArNwD+xllT6x+xllT6Eok1:k44rsRQA7Z6MZ6Eo8

Malware Config

Extracted

Family

xtremerat

C2

amo0ora.no-ip.biz

Targets

    • Target

      JaffaCakes118_0be3153bc7b02e4d8fffdf6d77f01c54

    • Size

      77KB

    • MD5

      0be3153bc7b02e4d8fffdf6d77f01c54

    • SHA1

      4c29ec546f2f783a04f079c89dd0dbecc6a0b304

    • SHA256

      891b6f5e7137fc34a674e8515bae5f5b95dbb33caaf7dfc73b3360021d3a0e05

    • SHA512

      c7eddd593613d915bf55247cfd3d9395558efd12a259988eadf306fa647b63a9757abaa7d24f4d9efd6d6e595912fa50dfcb88b86e66bf2b47401483e83abcfc

    • SSDEEP

      1536:9sq+QV4rObAdkoAf8UqiY/lArNwD+xllT6x+xllT6Eok1:k44rsRQA7Z6MZ6Eo8

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    • Xtremerat family

MITRE ATT&CK Enterprise v15

Tasks