Overview

overview

10

Static

static

5

JaffaCakes...fd.exe

windows7-x64

10

JaffaCakes...fd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_538ad6fc407f8042c63210a6a58158fd

  • Size

    347KB

  • Sample

    250129-gs5mgawkdr

  • MD5

    538ad6fc407f8042c63210a6a58158fd

  • SHA1

    55e9ec515b8d267d2c339c3c9f592d9ecbca9532

  • SHA256

    1d794f1467a7d322c53c128dc386633ecb41eb50f1c90d197ad9a59e765e36cf

  • SHA512

    76a60951c83c4f1ffe4fdf9cf0faf90831afda68162f2768b3650fde3b4cec53a0004db5ae09adc285d33a5c342fe5023120b1e2d4dd2701c7c87b2bf816f089

  • SSDEEP

    6144:oAFELV9WkhHnkpPlxhPG+hxHLjdw/4NzNXn85R7Iuyuy8wFto3zpHEkGU2hn1XE2:oA6bf5Ud3rjdJzxVuy8WolkkERy2

Score
10/10
xtremeratdiscoverypersistenceratspywareupx

Malware Config

Targets

    • Target

      JaffaCakes118_538ad6fc407f8042c63210a6a58158fd

    • Size

      347KB

    • MD5

      538ad6fc407f8042c63210a6a58158fd

    • SHA1

      55e9ec515b8d267d2c339c3c9f592d9ecbca9532

    • SHA256

      1d794f1467a7d322c53c128dc386633ecb41eb50f1c90d197ad9a59e765e36cf

    • SHA512

      76a60951c83c4f1ffe4fdf9cf0faf90831afda68162f2768b3650fde3b4cec53a0004db5ae09adc285d33a5c342fe5023120b1e2d4dd2701c7c87b2bf816f089

    • SSDEEP

      6144:oAFELV9WkhHnkpPlxhPG+hxHLjdw/4NzNXn85R7Iuyuy8wFto3zpHEkGU2hn1XE2:oA6bf5Ud3rjdJzxVuy8WolkkERy2

    Score
    10/10
    xtremeratdiscoverypersistenceratspywareupx

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Xtremerat family

      xtremerat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks