Overview

overview

10

Static

static

3

JaffaCakes...1a.exe

windows7-x64

10

JaffaCakes...1a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_aa3f313ac924c27b2d2fe5acf6c5401a

  • Size

    106KB

  • Sample

    250206-mrwaassmdy

  • MD5

    aa3f313ac924c27b2d2fe5acf6c5401a

  • SHA1

    63fcc3eb367d36544dcd0810310ed26ba5f3ce4c

  • SHA256

    7bec450473cf1cffaba40e912d04dd7cc5da0d00649f17c31a099557721c74d9

  • SHA512

    f07c87f247ca1346a5d4279730795c77b2a5150482482e7dca816278e7785d524c0c3ddf0997fe25ec20ce8cb5f29d68bda006e594e4f0ad64f2ffe964bb2a89

  • SSDEEP

    1536:rqHvMCaAweZSsHpy/RGeCyjmKq5D6pMFhWi+PUlOCX/Aq4eoiU:atUsHp+5xe5WWHAyo1

Score
10/10
xtremeratdiscoverypersistenceratspyware

Malware Config

Targets

    • Target

      JaffaCakes118_aa3f313ac924c27b2d2fe5acf6c5401a

    • Size

      106KB

    • MD5

      aa3f313ac924c27b2d2fe5acf6c5401a

    • SHA1

      63fcc3eb367d36544dcd0810310ed26ba5f3ce4c

    • SHA256

      7bec450473cf1cffaba40e912d04dd7cc5da0d00649f17c31a099557721c74d9

    • SHA512

      f07c87f247ca1346a5d4279730795c77b2a5150482482e7dca816278e7785d524c0c3ddf0997fe25ec20ce8cb5f29d68bda006e594e4f0ad64f2ffe964bb2a89

    • SSDEEP

      1536:rqHvMCaAweZSsHpy/RGeCyjmKq5D6pMFhWi+PUlOCX/Aq4eoiU:atUsHp+5xe5WWHAyo1

    Score
    10/10
    xtremeratdiscoverypersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Xtremerat family

      xtremerat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks