Overview

overview

10

Static

static

3

JaffaCakes...f4.exe

windows7-x64

10

JaffaCakes...f4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_b583755c8f8dedf40b6d43330780cdf4

  • Size

    116KB

  • Sample

    250207-lfkhzswngv

  • MD5

    b583755c8f8dedf40b6d43330780cdf4

  • SHA1

    24a2856ad72d76a8aa443ef45a25978ac69af236

  • SHA256

    52a362838964e4f568ece26ff87c43ab32f7da926497ed1911e8ae3ad98cfa11

  • SHA512

    33e7874fb7e480b311cb0d15cceadc808bdfbf6ff9088799d90c202d0524cd70c1dfff67a0aaa6d0da8d3bafdce3c6cd6833af2bab39a801c364f05358291055

  • SSDEEP

    1536:rZJfGWvBzgPCoP6V6Dfu0fXMpEnERCtsEpXVRHE57lUdwvIW8Akf4Etg0Say+Fxd:juWACJQW0fX5kCtsUghlnkAj0A+FC8H

Score
10/10
xtremeratdiscoverypersistenceratspyware

Malware Config

Targets

    • Target

      JaffaCakes118_b583755c8f8dedf40b6d43330780cdf4

    • Size

      116KB

    • MD5

      b583755c8f8dedf40b6d43330780cdf4

    • SHA1

      24a2856ad72d76a8aa443ef45a25978ac69af236

    • SHA256

      52a362838964e4f568ece26ff87c43ab32f7da926497ed1911e8ae3ad98cfa11

    • SHA512

      33e7874fb7e480b311cb0d15cceadc808bdfbf6ff9088799d90c202d0524cd70c1dfff67a0aaa6d0da8d3bafdce3c6cd6833af2bab39a801c364f05358291055

    • SSDEEP

      1536:rZJfGWvBzgPCoP6V6Dfu0fXMpEnERCtsEpXVRHE57lUdwvIW8Akf4Etg0Say+Fxd:juWACJQW0fX5kCtsUghlnkAj0A+FC8H

    Score
    10/10
    xtremeratdiscoverypersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Xtremerat family

      xtremerat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks