General
-
Target
JaffaCakes118_9dcdbb8d868ab09f3cf874282cae7dfc
-
Size
195KB
-
Sample
250205-kkrbnaymhv
-
MD5
9dcdbb8d868ab09f3cf874282cae7dfc
-
SHA1
7d40bf0f6ff872aead26a766fe59002f35c2b372
-
SHA256
b2205bf1ac85b2cfec1f6510570b0fd3af3f87ca30f121dd77cf4176030924ce
-
SHA512
77821fb4992b6cdefd121a3db32a0067f7155a6142fcbb7e3229134b72d708a599721bf73cfded5eba911b9adfa398a3d46f8f1595e98b33ca217ceb031f170a
-
SSDEEP
3072:yHpFKExTudqXHNEak3sMuRDx+76nRwGvT3OvN4W8APtV2i:cFKExDRk3sbRV+76nS3vN8gQi
Malware Config
Targets
-
-
Target
JaffaCakes118_9dcdbb8d868ab09f3cf874282cae7dfc
-
Size
195KB
-
MD5
9dcdbb8d868ab09f3cf874282cae7dfc
-
SHA1
7d40bf0f6ff872aead26a766fe59002f35c2b372
-
SHA256
b2205bf1ac85b2cfec1f6510570b0fd3af3f87ca30f121dd77cf4176030924ce
-
SHA512
77821fb4992b6cdefd121a3db32a0067f7155a6142fcbb7e3229134b72d708a599721bf73cfded5eba911b9adfa398a3d46f8f1595e98b33ca217ceb031f170a
-
SSDEEP
3072:yHpFKExTudqXHNEak3sMuRDx+76nRwGvT3OvN4W8APtV2i:cFKExDRk3sbRV+76nS3vN8gQi
Score10/10-
Detect XtremeRAT payload
-
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Xtremerat family
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Deletes itself
-
Adds Run key to start application
-
Drops file in System32 directory
-
Suspicious use of SetThreadContext
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1