Extracted

• • Target

    182935041a6ce5efbc832111db87ade3_JaffaCakes118

  • Size

    264KB

  • MD5

    182935041a6ce5efbc832111db87ade3

  • SHA1

    b8b077db3161c3c65b64a9b9aad2aa575f20212c

  • SHA256

    6111a8335e2ec3085b6093391b35671c6d0f5d01f93987b0456d66b9ffbcab28

  • SHA512

    c4ba1db72cd045f4d6988806630a8ccb39c933a57658a6f8f92f4b864e9305f88a48b88b8f03c9ed45929436137b631637689d2566619f2948d3dbdc79d22238

  • SSDEEP

    6144:pg0Swoiz/bOTNlCpd+BIG2uM+moV1gRGwHVoHnMP:pg0ff0n0d+BIG2RtCIiHn

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2