Overview

overview

10

Static

static

3

JaffaCakes...e9.exe

windows7-x64

10

JaffaCakes...e9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_139f03987f5c90dd2ddf1f15b3b6f7e9

  • Size

    316KB

  • Sample

    250123-etjqaasqer

  • MD5

    139f03987f5c90dd2ddf1f15b3b6f7e9

  • SHA1

    6976fd24a8a21e2443dde5141c6888d5c9beb99a

  • SHA256

    70ecb660294a422b52617a40c4e3e52bcd8eb91395542b38c57d8fc7974f74a5

  • SHA512

    306803f4527282672110eabc9b81a81f0b78c6a7dc3ec69b2306f9b7d8798c0fbdd9ec6ff622536511f3183912f64eefa602f8f03291d75b788394f0dc1f2962

  • SSDEEP

    3072:QUBTiskTuBL8ueZWt+VrqRHgG5FOEYYKvYut1yaHnd1OXHWVrqRHgG5FOEYYKvYJ:QlZZrqRHuxYK91b1+KrqRHuxYK9Y

Score
10/10
xtremeratdiscoverypersistenceratspyware

Malware Config

Targets

    • Target

      JaffaCakes118_139f03987f5c90dd2ddf1f15b3b6f7e9

    • Size

      316KB

    • MD5

      139f03987f5c90dd2ddf1f15b3b6f7e9

    • SHA1

      6976fd24a8a21e2443dde5141c6888d5c9beb99a

    • SHA256

      70ecb660294a422b52617a40c4e3e52bcd8eb91395542b38c57d8fc7974f74a5

    • SHA512

      306803f4527282672110eabc9b81a81f0b78c6a7dc3ec69b2306f9b7d8798c0fbdd9ec6ff622536511f3183912f64eefa602f8f03291d75b788394f0dc1f2962

    • SSDEEP

      3072:QUBTiskTuBL8ueZWt+VrqRHgG5FOEYYKvYut1yaHnd1OXHWVrqRHgG5FOEYYKvYJ:QlZZrqRHuxYK91b1+KrqRHuxYK9Y

    Score
    10/10
    xtremeratdiscoverypersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Xtremerat family

      xtremerat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks