Extracted

• • Target
    0cacb21837fe86eb24497240ac95d5fb_JaffaCakes118
  • Size 75KB
  • SHA256 7b2de5c7de27a69e56f9f01ec0e732abb31003ffc6af34ea9c4a03b10de7887d
  • MD5 0cacb21837fe86eb24497240ac95d5fb
  • SHA1 3ae55edd796556682131bf19a8723e13e3abc096
  • SHA512 780697d3aa1e77b884a25d47e8027b1dc74abb5d5858f460704648b095799e7c2034e394fa74177d30ed380c21b10eb6f7de21827045df83cb02122542980211
  • SSDEEP 1536:O3rxuzCpd5BWzMnCbSn2w6iQMcpp25Tf9uMr50AJWFD:O3NuzCJBWzaCbpCSkZfYM3ID
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xtremeratpersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2