Extracted

• • Target

    bf3e1f5477558b8c0d6e33d2a00d7a64_JaffaCakes118

  • Size

    2.9MB

  • MD5

    bf3e1f5477558b8c0d6e33d2a00d7a64

  • SHA1

    29155e4f22054ebd1587f345e0aabfa1fc25c9c2

  • SHA256

    9c00c0f3fdbb21eaac271555484fa15531accf907c7720f7f537822840e9a0af

  • SHA512

    4a9be98d67df74ddc4e0fce4b0d31cd1df09ff2798a8d7a2f8c711de577d7e23dcc35009ff79917c21a2159d09686ae7acc59daa7b897c19d9d1986592a13631

  • SSDEEP

    49152:wAyhhalameDeEuvdSCx8zFIPaEcxwy+PXwiI/uFxsgd8w:Mhh/meD1QSCx8pYcxwLwMz/ew

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2