Overview

overview

10

Static

static

3

JaffaCakes...4e.exe

windows7-x64

10

JaffaCakes...4e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_5aa1178f78b9916ac3406f341242e64e

  • Size

    69KB

  • Sample

    250129-x926nsxlht

  • MD5

    5aa1178f78b9916ac3406f341242e64e

  • SHA1

    2dbe5688b0ff9f2ea5aaadb82e7e85106807b0f7

  • SHA256

    e351fd731fd0a8c68269f6edf346fc08148f46c41c79bec0add5267ed807d225

  • SHA512

    dd6be7937109ced11b774c00e7aef02b0bbbd23eb2f69f85e169bdd5fdf8e449b5124e24ba62c6f5967cd722d0031cf6fd865761a400db5b03a626c95068a8de

  • SSDEEP

    1536:X9kWLe0yiIQNUPJhdaiQvoGsolQlou8Y+SfgLxlZFvw:X9pLVvNQRQwNolQOXY+Sfg9/

Score
10/10
xtremeratdiscoverypersistenceratspyware

Malware Config

Targets

    • Target

      JaffaCakes118_5aa1178f78b9916ac3406f341242e64e

    • Size

      69KB

    • MD5

      5aa1178f78b9916ac3406f341242e64e

    • SHA1

      2dbe5688b0ff9f2ea5aaadb82e7e85106807b0f7

    • SHA256

      e351fd731fd0a8c68269f6edf346fc08148f46c41c79bec0add5267ed807d225

    • SHA512

      dd6be7937109ced11b774c00e7aef02b0bbbd23eb2f69f85e169bdd5fdf8e449b5124e24ba62c6f5967cd722d0031cf6fd865761a400db5b03a626c95068a8de

    • SSDEEP

      1536:X9kWLe0yiIQNUPJhdaiQvoGsolQlou8Y+SfgLxlZFvw:X9pLVvNQRQwNolQOXY+Sfg9/

    Score
    10/10
    xtremeratdiscoverypersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Xtremerat family

      xtremerat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks