Extracted

• • Target
    2241ddcbf1e7b0e23d256f889ad6e26a_JaffaCakes118
  • Size 842KB
  • SHA256 8a3291faca87291212c18ef36210f5cba966e96cffac594225a279b956132396
  • MD5 2241ddcbf1e7b0e23d256f889ad6e26a
  • SHA1 e9291fec5c778aa7037f0eaaf6e980256c9a27c1
  • SHA512 b18540dc0dc57d2bf7551564bdf1deaaca5c85d155c8d0fe6f4fcb888ba32a24df3d05d29d6e8235fbef6b675d4fcc50af1092b89b566740023a51631a8c6d15
  • SSDEEP 24576:2AojG2m6TtySYXU9/UwlPGhnxy4i9XCWsu5agFya3TbaZo:A/PtySL9/UwluhnhuyWZagdTOZo
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xtremeratevasionpersistenceratspywaretrojanupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2