Overview

overview

10

Static

static

3

JaffaCakes...67.exe

windows7-x64

10

JaffaCakes...67.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367

  • Size

    436KB

  • Sample

    250206-dpsxqatkam

  • MD5

    a6a9e9adfc4c2d56d61765fea229f367

  • SHA1

    72781be5f79d9cdcb25e3431a3e4a2e64ee64d10

  • SHA256

    38e90a638c2d94ca427d48331c05729049a56ed9487e38fee3cfd6f855afba9f

  • SHA512

    c6c13ee9205dac6c9f83be5f8a940f6c837d6b8eea2e7906ac293aff78669218623c8cd8d4b9ae1c8bbaefcf3528477a80c9ac8d590bba9fc70bd7c4971897a2

  • SSDEEP

    12288:GjRLBCO5dIEGpzK6FSkFvVzkEGZosTj9U7++D+Ty:GjFRi5pzvJXGZHe7LDOy

Score
10/10
xtremeratdiscoverypersistenceratspyware

Malware Config

Targets

    • Target

      JaffaCakes118_a6a9e9adfc4c2d56d61765fea229f367

    • Size

      436KB

    • MD5

      a6a9e9adfc4c2d56d61765fea229f367

    • SHA1

      72781be5f79d9cdcb25e3431a3e4a2e64ee64d10

    • SHA256

      38e90a638c2d94ca427d48331c05729049a56ed9487e38fee3cfd6f855afba9f

    • SHA512

      c6c13ee9205dac6c9f83be5f8a940f6c837d6b8eea2e7906ac293aff78669218623c8cd8d4b9ae1c8bbaefcf3528477a80c9ac8d590bba9fc70bd7c4971897a2

    • SSDEEP

      12288:GjRLBCO5dIEGpzK6FSkFvVzkEGZosTj9U7++D+Ty:GjFRi5pzvJXGZHe7LDOy

    Score
    10/10
    xtremeratdiscoverypersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Xtremerat family

      xtremerat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks