Extracted

• • Target

    d51a0b0d2e4fb1400ab3ed1f57e76cf3_JaffaCakes118

  • Size

    41KB

  • MD5

    d51a0b0d2e4fb1400ab3ed1f57e76cf3

  • SHA1

    66128d870fdb4e8ac61f043190e4f551d1c95472

  • SHA256

    1252e934b22dc2bed95fb622b37641534f4af4786219175014aeb2b6bebfe254

  • SHA512

    443ed6c8a22cd8a726d84227ee668ff1775759eaa80daa445e422858f8bfe2ed12b14c32a91f9f29167136b8bd9c2d24cbe3b724a10c151dca77738d4b159a18

  • SSDEEP

    768:h+rdUw+iGh7OW15Mq6v1L6V9lC87DuFIA3vb2aSEFIA3vb2aS:h+D+iGh7OWng5uzA3vb9YA3vb9

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2