Extracted

• • Target
    441915eeaee051cd76aa9164f7da3b8a_JaffaCakes118
  • Size 69KB
  • SHA256 4dbb385bb56949e5728bb4cf1be5ab94f73295a023575a39097cb6ae43c585e4
  • MD5 441915eeaee051cd76aa9164f7da3b8a
  • SHA1 8bc6aa6ee4478f2d128d8a91d9065e67d4720b26
  • SHA512 c1c7fcd9a658781971a2bbd1e6029b560fee075238a878e187116facf4bd9b9763779b5040ba2af72d17bfe065de311615efa84482ce8c80670327b3b8217817
  • SSDEEP 768:MtYkDJKF4x35HEbda1f9n3mipGmlK2NGV6JsdnGyBHs8YOJ0ZDsTz6NGikGz9avp:6EFbdcf9Xp7lcVTdGZ/OcDqz5ikG4s7k
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xtremeratpersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2