Extracted

• • Target

    637e97f2935fb1acdbf178c7c3f38592_JaffaCakes118

  • Size

    549KB

  • MD5

    637e97f2935fb1acdbf178c7c3f38592

  • SHA1

    d6d279d1deecbb151aa9922b40f43ac38150ee51

  • SHA256

    c60a87960b88afd700039e2b5696dc16acf6b9f94bb35b5257d25f64d6ee6b77

  • SHA512

    f113b80e264594738bd5ac07f84f57db5d992183fa0add8499f4ceb9614eb2bc7b17fbb3fa5083d035538279b74fde685fd1b71893c175288d335d625fb420cf

  • SSDEEP

    12288:6GuWm0QRVRdgFkEXIc0pg3xTX2ep3vWQrWKk:Xc7dgadoTXFdeaWf

  Score

  10^/10

  xtremeratpersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2