Overview

overview

10

Static

static

3

2655a561ca...18.exe

windows7-x64

10

2655a561ca...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2655a561cab708a2f5cb053942f3e510_JaffaCakes118

  • Size

    76KB

  • Sample

    240704-1m24yatakc

  • MD5

    2655a561cab708a2f5cb053942f3e510

  • SHA1

    dfccf9e17a91e0d1fe2267284de4772adeaa4325

  • SHA256

    babd8d0db22a6c7d0a9f21ba477f87964d6a05e1673cc9271a6a687f13f53621

  • SHA512

    3921b8c92e79d7e77e7316d34b57a14926a8548bebd1b275cdd5229c06cd2fecb4448f99d811e58c0defce45d6f4c66f4af3f7951f7bf1efa971ebda65557e68

  • SSDEEP

    1536:Bb6HygArDJUvOEfmhkM/Wsqq16jIR751FjOzow3OmI3/XU4lRtMi7p2J:deygoU2OmXWsojIR91FW+mh4lR9i

Score
10/10
xtremeratpersistenceratspyware

Malware Config

Targets

    • Target

      2655a561cab708a2f5cb053942f3e510_JaffaCakes118

    • Size

      76KB

    • MD5

      2655a561cab708a2f5cb053942f3e510

    • SHA1

      dfccf9e17a91e0d1fe2267284de4772adeaa4325

    • SHA256

      babd8d0db22a6c7d0a9f21ba477f87964d6a05e1673cc9271a6a687f13f53621

    • SHA512

      3921b8c92e79d7e77e7316d34b57a14926a8548bebd1b275cdd5229c06cd2fecb4448f99d811e58c0defce45d6f4c66f4af3f7951f7bf1efa971ebda65557e68

    • SSDEEP

      1536:Bb6HygArDJUvOEfmhkM/Wsqq16jIR751FjOzow3OmI3/XU4lRtMi7p2J:deygoU2OmXWsojIR91FW+mh4lR9i

    Score
    10/10
    xtremeratpersistenceratspyware

    • Detect XtremeRAT payload

    • XtremeRAT

      The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

      persistencespywareratxtremerat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Active Setup

1
T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

2
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Active Setup

1
T1547.014

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks