General
-
Target
JaffaCakes118_0c3ccccbde48e05466821967f4288347
-
Size
155KB
-
Sample
250220-rddwbawmaw
-
MD5
0c3ccccbde48e05466821967f4288347
-
SHA1
0c62e7373052b381bfe7111607ddf54cd723db55
-
SHA256
84ad0944c61d1708b6047da27072ad90eb1a685e07cb08a2bb7ac394e9316952
-
SHA512
6b856cae4a3ad8acf9f44c1afafcd84c22f89f1d07bd152e55f4537f9b723f39a519c5e52f368620f295ae407348d27450cc083b89ce4f0c36efd4815c0c12d5
-
SSDEEP
1536:PUwsQcmvkTpYYuNSu8lZUyWuNH9gCUgTqUKs0wDc19ZZY0lCDDKnV6CnuvGnG:sTAkTpYxwvngCUYqrsLl0lKoV6OuOnG
Malware Config
Targets
-
-
Target
JaffaCakes118_0c3ccccbde48e05466821967f4288347
-
Size
155KB
-
MD5
0c3ccccbde48e05466821967f4288347
-
SHA1
0c62e7373052b381bfe7111607ddf54cd723db55
-
SHA256
84ad0944c61d1708b6047da27072ad90eb1a685e07cb08a2bb7ac394e9316952
-
SHA512
6b856cae4a3ad8acf9f44c1afafcd84c22f89f1d07bd152e55f4537f9b723f39a519c5e52f368620f295ae407348d27450cc083b89ce4f0c36efd4815c0c12d5
-
SSDEEP
1536:PUwsQcmvkTpYYuNSu8lZUyWuNH9gCUgTqUKs0wDc19ZZY0lCDDKnV6CnuvGnG:sTAkTpYxwvngCUYqrsLl0lKoV6OuOnG
Score10/10-
Detect XtremeRAT payload
-
XtremeRAT
The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.
-
Xtremerat family
-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1