Extracted

• • Target

    af87ef6f09efa683368bcee63e9c5cd2_JaffaCakes118

  • Size

    210KB

  • MD5

    af87ef6f09efa683368bcee63e9c5cd2

  • SHA1

    3b917c4af81922ce075a0c2134e10316d52aa0b6

  • SHA256

    ef7e693bfdbf4795e03e3ada6310982f06fb641c7e7807169cd0cdf245e761d8

  • SHA512

    6b4f6c4c3b430d4629b5c4c4742574f620090a0bd0382d79d67d1e81fffa78fce3c5328c3160503bf0d1f7c6e8196ccaa8238b2b3a88b3f2e52fb1486913d0af

  • SSDEEP

    6144:y0n8ObG2FIMB4TyQOI5JgpcvqNplcT86Sp:yovPOT0Iw5pM86Sp

  Score

  10^/10

  xtremeratbootkitdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2