Extracted

• • Target

    53facfdf8219a139fa7c928c05737ccd_JaffaCakes118

  • Size

    44KB

  • MD5

    53facfdf8219a139fa7c928c05737ccd

  • SHA1

    265276d5c1cf841690fd0cf40de55507399fa20d

  • SHA256

    e19b44b2996629c059329bb07297cf98b41ade8439add0c2187a93d6eab0c72b

  • SHA512

    042f28b0d80ee0e45b2168f57cbbb55066eaa4d3de3dbbf4bc68baf2e2b3d592299f59720a1edf1313c74a91439798126662da9133e7754b825488cbcad109fc

  • SSDEEP

    768:rBr+tjFqTPkAlfztB1lr6an3smTA8uvm2DfOTwYPIFzocja:FyRUHlrL1lr6an3TLuvm2buQVo0a

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2