Overview

overview

10

Static

static

3

JaffaCakes...56.exe

windows7-x64

10

JaffaCakes...56.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_d19ffe885b0665fe6e963bf802b8dd56

  • Size

    46KB

  • Sample

    250209-vl9vhaxlbr

  • MD5

    d19ffe885b0665fe6e963bf802b8dd56

  • SHA1

    7ceebbff34ace41d11212f2b47861c3b0b94dfd3

  • SHA256

    59993a80ff2a8b2a2be7f6ca91f4299b8dcafcda0658eb4affd198b1145515d5

  • SHA512

    38ebf23c4c65f28c2756870ba350ccaeba0e5a7cd21b395755a4948e53820c5149d01c4c6a1215748a8a70f33914281140b2d0c1714844581bb4e43be2fb8382

  • SSDEEP

    768:ppbJ+jv+1biAOPiqxhorGTPPzRmOl8CSCVqiBsLU+IQjLeCYr:pdJ+jCOaKdTXzQBfzLUop

Score
10/10
xtremeratdiscoverypersistenceratspywareupx

Malware Config

Targets

    • Target

      JaffaCakes118_d19ffe885b0665fe6e963bf802b8dd56

    • Size

      46KB

    • MD5

      d19ffe885b0665fe6e963bf802b8dd56

    • SHA1

      7ceebbff34ace41d11212f2b47861c3b0b94dfd3

    • SHA256

      59993a80ff2a8b2a2be7f6ca91f4299b8dcafcda0658eb4affd198b1145515d5

    • SHA512

      38ebf23c4c65f28c2756870ba350ccaeba0e5a7cd21b395755a4948e53820c5149d01c4c6a1215748a8a70f33914281140b2d0c1714844581bb4e43be2fb8382

    • SSDEEP

      768:ppbJ+jv+1biAOPiqxhorGTPPzRmOl8CSCVqiBsLU+IQjLeCYr:pdJ+jCOaKdTXzQBfzLUop

    Score
    10/10
    xtremeratdiscoverypersistenceratspywareupx

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Xtremerat family

      xtremerat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks