Overview

overview

10

Static

static

3

JaffaCakes...d9.exe

windows7-x64

10

JaffaCakes...d9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_92463f77f40595d193ec96d7110ca7d9

  • Size

    597KB

  • Sample

    250204-la8zdstpam

  • MD5

    92463f77f40595d193ec96d7110ca7d9

  • SHA1

    a1ef00f5635ade5de097373d89710cf00f16bfe3

  • SHA256

    3ea0ae2b4f2ef54ec31a155fd20c493ebc6aae640aadf20a2731f50e3e1242f0

  • SHA512

    59116d3df98e5ac0aecffc71328cc3d6065bbc193df1fc2555ebcc71783a3cdc16600ef54a6bf6aabcb3de6a230fc592bf302c8a879d817b6a6e3dcc5df7b7a5

  • SSDEEP

    12288:WqucHnZrJ2WFtJMOqf2Q1/1MoF5+eh8aWvp2g1iqoY3t+vVLtT/:tr0YtKOqr1i+H6aWvpX3uVLtT/

Score
10/10
xtremeratdiscoverypersistenceratspywareupx

Malware Config

Targets

    • Target

      JaffaCakes118_92463f77f40595d193ec96d7110ca7d9

    • Size

      597KB

    • MD5

      92463f77f40595d193ec96d7110ca7d9

    • SHA1

      a1ef00f5635ade5de097373d89710cf00f16bfe3

    • SHA256

      3ea0ae2b4f2ef54ec31a155fd20c493ebc6aae640aadf20a2731f50e3e1242f0

    • SHA512

      59116d3df98e5ac0aecffc71328cc3d6065bbc193df1fc2555ebcc71783a3cdc16600ef54a6bf6aabcb3de6a230fc592bf302c8a879d817b6a6e3dcc5df7b7a5

    • SSDEEP

      12288:WqucHnZrJ2WFtJMOqf2Q1/1MoF5+eh8aWvp2g1iqoY3t+vVLtT/:tr0YtKOqr1i+H6aWvpX3uVLtT/

    Score
    10/10
    xtremeratdiscoverypersistenceratspywareupx

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Xtremerat family

      xtremerat

    • Adds policy Run key to start application

      persistence

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks