Overview

overview

10

Static

static

3

JaffaCakes...16.exe

windows7-x64

10

JaffaCakes...16.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_74c6ae456868e8af5f1f381380698a16

  • Size

    200KB

  • Sample

    250201-xranpswjes

  • MD5

    74c6ae456868e8af5f1f381380698a16

  • SHA1

    1159ec5cf06d6458e850ec2c120f43c5254ab614

  • SHA256

    c28eb7adc19622cf758d8cf50dd5d5ecda5b3ab2bba4b4371d71a1d26cdffdcc

  • SHA512

    168aac57b5e83abf35c589dbe5e1291a3e529723481766527523f192f89c7dc78bf1e6383aaa1b41de12e93e090dac98a72f7ade623b893c7e04bfc1adf99a2e

  • SSDEEP

    3072:HVojj3az/DS9XMjaQTC+YgEAQIIOraBIpPQMPo+Pzrc77OWw8x8cv:H+6HSMaOiAdraBCDoAc769/c

Score
10/10
xtremeratdiscoverypersistenceratspywareupx

Malware Config

Targets

    • Target

      JaffaCakes118_74c6ae456868e8af5f1f381380698a16

    • Size

      200KB

    • MD5

      74c6ae456868e8af5f1f381380698a16

    • SHA1

      1159ec5cf06d6458e850ec2c120f43c5254ab614

    • SHA256

      c28eb7adc19622cf758d8cf50dd5d5ecda5b3ab2bba4b4371d71a1d26cdffdcc

    • SHA512

      168aac57b5e83abf35c589dbe5e1291a3e529723481766527523f192f89c7dc78bf1e6383aaa1b41de12e93e090dac98a72f7ade623b893c7e04bfc1adf99a2e

    • SSDEEP

      3072:HVojj3az/DS9XMjaQTC+YgEAQIIOraBIpPQMPo+Pzrc77OWw8x8cv:H+6HSMaOiAdraBCDoAc769/c

    Score
    10/10
    xtremeratdiscoverypersistenceratspywareupx

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Xtremerat family

      xtremerat

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks