Extracted

• • Target
    306f694159d8b3b3917769c6026756bf_JaffaCakes118
  • Size 272KB
  • SHA256 2b6fa41a3067241fda1be99c77e4712eddd8b1f6f0e5fc326f9333431c86a434
  • MD5 306f694159d8b3b3917769c6026756bf
  • SHA1 c64b421af8337839aaa9bba8d466d81e80289463
  • SHA512 6d30fc4d93df55ff2c41a910585c0a6e5e091a09c439804db5615e9206c743726fec871b569877a4f55bb4ee35fe951ece58c0bd7e374fadfa8e2094384f798b
  • SSDEEP 6144:V9gwx5d/WMXKhOO75uym8HQuUdKd1FShv+C+e+GNLBRoA:V9gwMMdIuF8H5UdKTFev7+0N1R9
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xtremeratpersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2