Overview

overview

10

Static

static

3

JaffaCakes...6d.exe

windows7-x64

10

JaffaCakes...6d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_39d801f58ce55e868801333e3dacce6d

  • Size

    122KB

  • Sample

    250126-2sclxaypal

  • MD5

    39d801f58ce55e868801333e3dacce6d

  • SHA1

    ba1cd7fe13b6413b3d6df00392727cad81fdb058

  • SHA256

    51a99ba9672c9be5b7da59bc033b12726d70460d5f9ff7c8c599db73c17d6f8a

  • SHA512

    44bc77acd925500cbab39e6dd073cdf1ce5ef5c054da57a8f6d822fd50c6a7eaf2f71afaf99340246e080c7262e10de6d581727701c39fef5aae3d20807f78cf

  • SSDEEP

    3072:piBiyJ+MgpIOszYpew6bI/5hoqNz2OUKCXoA2n+Hx/do:GiysMq+Yt6K5KNzokR

Score
10/10
xtremeratdefense_evasiondiscoverypersistenceratspyware

Malware Config

Targets

    • Target

      JaffaCakes118_39d801f58ce55e868801333e3dacce6d

    • Size

      122KB

    • MD5

      39d801f58ce55e868801333e3dacce6d

    • SHA1

      ba1cd7fe13b6413b3d6df00392727cad81fdb058

    • SHA256

      51a99ba9672c9be5b7da59bc033b12726d70460d5f9ff7c8c599db73c17d6f8a

    • SHA512

      44bc77acd925500cbab39e6dd073cdf1ce5ef5c054da57a8f6d822fd50c6a7eaf2f71afaf99340246e080c7262e10de6d581727701c39fef5aae3d20807f78cf

    • SSDEEP

      3072:piBiyJ+MgpIOszYpew6bI/5hoqNz2OUKCXoA2n+Hx/do:GiysMq+Yt6K5KNzokR

    Score
    10/10
    xtremeratdefense_evasiondiscoverypersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Xtremerat family

      xtremerat

    • Disables Task Manager via registry modification

      defense_evasion

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks