Overview

overview

10

Static

static

3

JaffaCakes...6a.exe

windows7-x64

10

JaffaCakes...6a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_4bde8f0106a634f5db438cec9dd17b6a

  • Size

    121KB

  • Sample

    250128-rrfxts1nft

  • MD5

    4bde8f0106a634f5db438cec9dd17b6a

  • SHA1

    e198af6e680729e5d0703b3ce9270eab50ce9cad

  • SHA256

    d1ca348a5190346a4ea5899a85754ffbeb832900edc5f26dddcc04cb6fe21d8a

  • SHA512

    2d4b9d2490666b2ab5a6b474fb0e9fd6851a0ce77c3e79f2bf1f49d47ef2fc36da354318f9613de828b0ffe73fe04ce718286903b1eb8784ee979fe0e58da1cb

  • SSDEEP

    3072:bssmJjFCzCQZxJX7Zvwz/flgnL4pi+t5AJT+2X2G:4zWzzZxHQOL47Adn

Score
10/10
xtremeratdiscoverypersistenceratspyware

Malware Config

Targets

    • Target

      JaffaCakes118_4bde8f0106a634f5db438cec9dd17b6a

    • Size

      121KB

    • MD5

      4bde8f0106a634f5db438cec9dd17b6a

    • SHA1

      e198af6e680729e5d0703b3ce9270eab50ce9cad

    • SHA256

      d1ca348a5190346a4ea5899a85754ffbeb832900edc5f26dddcc04cb6fe21d8a

    • SHA512

      2d4b9d2490666b2ab5a6b474fb0e9fd6851a0ce77c3e79f2bf1f49d47ef2fc36da354318f9613de828b0ffe73fe04ce718286903b1eb8784ee979fe0e58da1cb

    • SSDEEP

      3072:bssmJjFCzCQZxJX7Zvwz/flgnL4pi+t5AJT+2X2G:4zWzzZxHQOL47Adn

    Score
    10/10
    xtremeratdiscoverypersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Xtremerat family

      xtremerat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks