Overview

overview

10

Static

static

3

JaffaCakes...fa.exe

windows7-x64

10

JaffaCakes...fa.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_4d0970ecb7da2690aa9e65d37cd405fa

  • Size

    104KB

  • Sample

    250128-t6xv1avlft

  • MD5

    4d0970ecb7da2690aa9e65d37cd405fa

  • SHA1

    55cb0d1dad7d6f87255eb401227a2826dd4f6e42

  • SHA256

    55fc5a58eafe06777bf0063572259ad6d83a43834d6acd32a4230b4f8d8302d7

  • SHA512

    0447624d21bd93e13ac703247315068b17016fb433b04805f99b22c7e258bfa71fa482e8b2811db47e8f2ae1f90184ad3259b76d2136f06051fdfc4083252816

  • SSDEEP

    3072:FN2nGADQVDV4+P8xVQ7FSAhyBrSLwPHnWh6mOhoY2:nVDV4CMVQ7FThGHWh6mJY

Score
10/10
xtremeratdiscoverypersistenceratspywareupx

Malware Config

Targets

    • Target

      JaffaCakes118_4d0970ecb7da2690aa9e65d37cd405fa

    • Size

      104KB

    • MD5

      4d0970ecb7da2690aa9e65d37cd405fa

    • SHA1

      55cb0d1dad7d6f87255eb401227a2826dd4f6e42

    • SHA256

      55fc5a58eafe06777bf0063572259ad6d83a43834d6acd32a4230b4f8d8302d7

    • SHA512

      0447624d21bd93e13ac703247315068b17016fb433b04805f99b22c7e258bfa71fa482e8b2811db47e8f2ae1f90184ad3259b76d2136f06051fdfc4083252816

    • SSDEEP

      3072:FN2nGADQVDV4+P8xVQ7FSAhyBrSLwPHnWh6mOhoY2:nVDV4CMVQ7FThGHWh6mJY

    Score
    10/10
    xtremeratdiscoverypersistenceratspywareupx

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Xtremerat family

      xtremerat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks