Overview

overview

10

Static

static

7

JaffaCakes...1f.exe

windows7-x64

10

JaffaCakes...1f.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_7175b619105d8618a7e067968c410d1f

  • Size

    668KB

  • Sample

    250201-n3hzsasqgl

  • MD5

    7175b619105d8618a7e067968c410d1f

  • SHA1

    2facd36001f2856f6263ddb6563551444b5e059b

  • SHA256

    111125a20af8ed7f451be275ef14c0d471c0409670fa4458cfa4c1b64e0edd3d

  • SHA512

    f1dbc9665413ee4797371131842022453e08f8196325ed01b2e014234232d037e506d9db089971da6ed8ddc007b8604aaa37057359bf5ff72e63704220d80593

  • SSDEEP

    12288:TFknOpqVpPRHzsbPSDrh6s35/sCkNgdbsKVqtDhyp5mFUennqwiStw+JaWyk0i9z:TFkBVp5TSKDrcsV1dsjh6tKNaan+i9

Score
10/10
xtremeratdefense_evasiondiscoverypersistenceratspywarethemida

Malware Config

Targets

    • Target

      JaffaCakes118_7175b619105d8618a7e067968c410d1f

    • Size

      668KB

    • MD5

      7175b619105d8618a7e067968c410d1f

    • SHA1

      2facd36001f2856f6263ddb6563551444b5e059b

    • SHA256

      111125a20af8ed7f451be275ef14c0d471c0409670fa4458cfa4c1b64e0edd3d

    • SHA512

      f1dbc9665413ee4797371131842022453e08f8196325ed01b2e014234232d037e506d9db089971da6ed8ddc007b8604aaa37057359bf5ff72e63704220d80593

    • SSDEEP

      12288:TFknOpqVpPRHzsbPSDrh6s35/sCkNgdbsKVqtDhyp5mFUennqwiStw+JaWyk0i9z:TFkBVp5TSKDrcsV1dsjh6tKNaan+i9

    Score
    10/10
    xtremeratdefense_evasiondiscoverypersistenceratspywarethemida

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Xtremerat family

      xtremerat

    • Identifies Wine through registry keys

      Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

      defense_evasion

    • Themida packer

      Detects Themida, an advanced Windows software protection system.

      themida

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks