Overview

overview

10

Static

static

3

JaffaCakes...3f.exe

windows7-x64

10

JaffaCakes...3f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_2fed934f5f0a045d2394159d7b860c3f

  • Size

    107KB

  • Sample

    250125-1nckns1mfz

  • MD5

    2fed934f5f0a045d2394159d7b860c3f

  • SHA1

    4d502a682fd9b9867462b5402b77416cbf8c75f1

  • SHA256

    06bffd2927fc17064dedc8dcce1fc5f734a01ab07be8eb7512cc0f8a91374377

  • SHA512

    5782b5e82ca79856eaac7eec20e7bf6fe96680b156976d047d3055dff7c4e2eab3ded2dbd0ae9fb457072df7aad2bd46e0d97e0e4c0c97a112f7231adf15e5ff

  • SSDEEP

    1536:wleFkLjr+fEQclXjwXkXhULR+VXG6te793YYXpmZtsjXTP76NA+KpODYDpfoRNUy:wxL3Xp2R+JQBoYXpetUr0ApODYDpfSN

Score
10/10
xtremeratdiscoverypersistenceratspyware

Malware Config

Targets

    • Target

      JaffaCakes118_2fed934f5f0a045d2394159d7b860c3f

    • Size

      107KB

    • MD5

      2fed934f5f0a045d2394159d7b860c3f

    • SHA1

      4d502a682fd9b9867462b5402b77416cbf8c75f1

    • SHA256

      06bffd2927fc17064dedc8dcce1fc5f734a01ab07be8eb7512cc0f8a91374377

    • SHA512

      5782b5e82ca79856eaac7eec20e7bf6fe96680b156976d047d3055dff7c4e2eab3ded2dbd0ae9fb457072df7aad2bd46e0d97e0e4c0c97a112f7231adf15e5ff

    • SSDEEP

      1536:wleFkLjr+fEQclXjwXkXhULR+VXG6te793YYXpmZtsjXTP76NA+KpODYDpfoRNUy:wxL3Xp2R+JQBoYXpetUr0ApODYDpfSN

    Score
    10/10
    xtremeratdiscoverypersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Xtremerat family

      xtremerat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks