Extracted

• • Target

    6f4b4fad8040c4c9432810e57756562a_JaffaCakes118

  • Size

    44KB

  • MD5

    6f4b4fad8040c4c9432810e57756562a

  • SHA1

    a57588b056e134b6d8f9748f339eacbd274cde8f

  • SHA256

    e4c8b6ef8ff2bf11700e1e5badaa593510b2fc5675c9d7fa6d709bcef2b76481

  • SHA512

    fe94310e5e083e287a01a2a88cc76179e98d09376d23c108543a48579b3677756028a97f3fc3e3ab8cf4e2904cd874190a0df07d8e1f226b790365edfb59306e

  • SSDEEP

    768:rBr+tjFqTPkAlfztB1lr6an3smTA8uvm2DfOTwYPIUzoNpJ:FyRUHlrL1lr6an3TLuvm2buQ0oNpJ

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • Modifies WinLogon for persistence

    persistence

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2