Extracted

• • Target

    6a3223f1f07782712b76d01dc536b28c_JaffaCakes118

  • Size

    498KB

  • MD5

    6a3223f1f07782712b76d01dc536b28c

  • SHA1

    36c938c6bff74681cee43e9ccb73df534e2133fa

  • SHA256

    5bb2393937bd60a9f210e89979a4a57d430680dd37dba1c0516132748d041372

  • SHA512

    b0a7a8d07d1e70ce286b605c00357096eb42b66ab24f155f7734a6b2327f675f78c72fc65800b45270297e31fe3e9a2b5fa35dc246777f9b556dd493fd2ca963

  • SSDEEP

    12288:Xa7+LRle3Hytwjx08k4MfnybUqh/sBKFKc6P3prfspwDzY:X3RUZk4OkfEvPPlf7Ds

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory

  behavioral1behavioral2