Extracted

• • Target

    c9374c394596b7b214b8008ea8b72934_JaffaCakes118

  • Size

    1.0MB

  • MD5

    c9374c394596b7b214b8008ea8b72934

  • SHA1

    e8de52dce3676598d6b8d01aff1c51fb64a634a0

  • SHA256

    b468b9a17083e273b8a7423f3954fab44c2979227ddb5c232b12a243135958de

  • SHA512

    cad54aa270b8377acc88dcf1c0f5c5887f0bb84c6391833a381443ec77f82080a9702ae39e3b2af2ed64a5369a060d4aaacd204f282ad1df81b0f095ae4161a0

  • SSDEEP

    12288:JaLNn0idiEDCOb5klzPYbT9laDWU9lmoXcQLG1KcKDT+A/ixV:JaLiidiEDr6JlGQagZ

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2