Overview

overview

10

Static

static

3

JaffaCakes...4e.exe

windows7-x64

10

JaffaCakes...4e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_3f363190678e26a115439539652a8f4e

  • Size

    113KB

  • Sample

    250127-ntzwyawqgv

  • MD5

    3f363190678e26a115439539652a8f4e

  • SHA1

    52f3e5ce495420a5b737a02708c9c8eb99e0e11c

  • SHA256

    017b82ea2475a6c2b395c66f6fab225fca247d36f480c85cb2556cbbcc240558

  • SHA512

    7a43198b4db8afa99d39f0bb75b5505487b49d87af8b96d3c1e97c5ac8008ae5b4d5ba8f84b653d6deadfe797f063926f87dad7d428d1ced5757b4e02d3394b6

  • SSDEEP

    1536:ICSp7B0RGwWyuTYGUFwMeAur6vcOAFpRJNF+75DUSvHgMpvP5D9xS3rHBn7:Irdq8dEMF+ErFnJkUmAMVRmL17

Score
10/10
xtremeratdiscoverypersistenceratspyware

Malware Config

Targets

    • Target

      JaffaCakes118_3f363190678e26a115439539652a8f4e

    • Size

      113KB

    • MD5

      3f363190678e26a115439539652a8f4e

    • SHA1

      52f3e5ce495420a5b737a02708c9c8eb99e0e11c

    • SHA256

      017b82ea2475a6c2b395c66f6fab225fca247d36f480c85cb2556cbbcc240558

    • SHA512

      7a43198b4db8afa99d39f0bb75b5505487b49d87af8b96d3c1e97c5ac8008ae5b4d5ba8f84b653d6deadfe797f063926f87dad7d428d1ced5757b4e02d3394b6

    • SSDEEP

      1536:ICSp7B0RGwWyuTYGUFwMeAur6vcOAFpRJNF+75DUSvHgMpvP5D9xS3rHBn7:Irdq8dEMF+ErFnJkUmAMVRmL17

    Score
    10/10
    xtremeratdiscoverypersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Xtremerat family

      xtremerat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks