Extracted

• • Target

    3dc167bfeda3d67eb1016b6fa94309b5_JaffaCakes118

  • Size

    113KB

  • MD5

    3dc167bfeda3d67eb1016b6fa94309b5

  • SHA1

    508c61155cf874639047308c988ce1e0cf4d5a9a

  • SHA256

    de5b287cb54c54a3b20f5b6759d1903573aa9a9be4e313d82d294c30f5458932

  • SHA512

    4b43a9f84697b42fc9b31c26733f308103d73a5fbfc0e7034cf92a891167161a7ef9e465d9cbf257824c57b70ed31146520cd267e235a02fcf7590f87b585056

  • SSDEEP

    3072:CjNWM9EshVbzIgnsZNEXzXCnhNOhkhnlEM:CjNp9JhRIiklEM

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • Modifies WinLogon for persistence

    persistence

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2