Extracted

• • Target

    a500d48ed4e5e5dc987be8c9d2387531_JaffaCakes118

  • Size

    44KB

  • MD5

    a500d48ed4e5e5dc987be8c9d2387531

  • SHA1

    b7c64c61f8b6459898a42bc0b025d58b8e1a3a81

  • SHA256

    03f9e9f645bd3c337e61106f2c0bde8f01db0be29cd3e346da1fd98803a52bac

  • SHA512

    e9d3a32f1eb50490ea9a1f57798376f654393f5d75be87a31e4c7d08ea6a1e162d8d4721236825b386003b88f1494f0dab0a67271bfd050909b924b3b400e568

  • SSDEEP

    768:AD++tjFqTPkAlfzth1lr6annsmTq8uvm2DfOTwYPIWzoOL:uNRUHlrr1lr6anHTZuvm2buQKoOL

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2