Extracted

• • Target
    01cc682577fb30cd08429b8ad350a9be_JaffaCakes118
  • Size 93KB
  • SHA256 36044e4567ba9b917ca2789e3a1fa826bc358b0085d621dd8344d0433a5849b3
  • MD5 01cc682577fb30cd08429b8ad350a9be
  • SHA1 d99d5b21c4aff328a4edece3f295f746036d9573
  • SHA512 b424a498424c4ff609217a6df38169c1faa7a3dac93860fa3c1a6be0f3050d49fa5ae484d4ab6a138bb5f7f56d91b93f6eca78b2b7bb1c90c571456b351267ca
  • SSDEEP 1536:HT1sYrWt5NR4q55lXP/XSekEMvWkpn5prJTt6Cq0owKRMDwOiRGJP:HtELR5lXnXSek/rnFtE+KRGjJ
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xtremeratpersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Drops file in Drivers directory

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2