Extracted

• • Target

    1b106905375da8d8c438068468cfeb64_JaffaCakes118

  • Size

    44KB

  • MD5

    1b106905375da8d8c438068468cfeb64

  • SHA1

    02d780553db3329835449f3fd1ea2f6ef180f0ae

  • SHA256

    f08c877a9586225280053963fc28094bea815a39192f40db491a28dbba4be118

  • SHA512

    9abc5ef91b537e2cba45dc14f033ecbdc38a5aacc9e05f451471665a06478d491414fe6624be335a7e7da94326829bd63b12fc7f32f2b7613619848cf11ddba9

  • SSDEEP

    768:rBr+tjFqTPkAlfztB1lr6an3smTg8uvm28fOTwYPI1zov7J:FyRUHlrL1lr6an3Truvm2WuQlov7J

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2