Extracted

• • Target
    3a819e1ce4c18ecce8115195043a0c50_JaffaCakes118
  • Size 194KB
  • SHA256 3e97b2fc541b3a23e2fb612f7b272a9619b25cd446e288bbb0a4c94944712513
  • MD5 3a819e1ce4c18ecce8115195043a0c50
  • SHA1 462f26db8f151bb0f77882ca788f864c7f767aa6
  • SHA512 786ece052f1272062cfe060a9e06ec3b8381f8e79c0ec433d5193a928b63c32fa4611f3eaa1befb4d27957b431af0addd9a6456ffba6e88b6daa2f95b74fdd3a
  • SSDEEP 3072:L3gbjAOEY4TjVzg8252TDH+U0p+Cjey9NxOjCzYsKF8ttY8QoQAEJ0by:T+81Y4TZg8ZH+U0hj19NxECzYBKMq/u
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xtremeratevasionpersistenceratspywareupx

  • Detect XtremeRAT payload

  • Modifies firewall policy service

    evasion

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence
  behavioral1behavioral2