Overview

overview

10

Static

static

3

JaffaCakes...0a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_aa9a4a3a821808c7e845be5d4838e40a

  • Size

    650KB

  • Sample

    250410-r9vtpsvtbt

  • MD5

    aa9a4a3a821808c7e845be5d4838e40a

  • SHA1

    977d81c914952a5c64e3d0be436bff8208aff8b5

  • SHA256

    1987350d9ef693e23c750c39fa6317ca17209e7c397755029e2e5ebc401b17e9

  • SHA512

    80e04cd4302dff4957474248236033473c5f430cc0a2cb7088b70016f72a97e0f1f6072bdfe39ac532b09435cf0db12098f3d1fbfe460b5bba911c5534ab8f5a

  • SSDEEP

    12288:JB2tHKSWCYYuVRcKLMxHzO0xQ5m26R1tvREcXBi9rmD3SEc:JB2tHKSVY1sxHyV6RXvKcXBqrm2Ec

Score
10/10
xtremeratdiscoverypersistenceratspyware

Malware Config

Targets

    • Target

      JaffaCakes118_aa9a4a3a821808c7e845be5d4838e40a

    • Size

      650KB

    • MD5

      aa9a4a3a821808c7e845be5d4838e40a

    • SHA1

      977d81c914952a5c64e3d0be436bff8208aff8b5

    • SHA256

      1987350d9ef693e23c750c39fa6317ca17209e7c397755029e2e5ebc401b17e9

    • SHA512

      80e04cd4302dff4957474248236033473c5f430cc0a2cb7088b70016f72a97e0f1f6072bdfe39ac532b09435cf0db12098f3d1fbfe460b5bba911c5534ab8f5a

    • SSDEEP

      12288:JB2tHKSWCYYuVRcKLMxHzO0xQ5m26R1tvREcXBi9rmD3SEc:JB2tHKSVY1sxHyV6RXvKcXBqrm2Ec

    Score
    10/10
    xtremeratdiscoverypersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Xtremerat family

      xtremerat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks