Extracted

• • Target

    7a917fd27a6e574cc4d722049e2e47f1_JaffaCakes118

  • Size

    67KB

  • MD5

    7a917fd27a6e574cc4d722049e2e47f1

  • SHA1

    586d1e930193e58ecf80277a5fad52d5b0ad24f3

  • SHA256

    a1e54b743426f32cf96dcb45aa6becb44fc7de9f9b73154cf9188335abfd1e20

  • SHA512

    12e580195a311a13d5cf04964d06e78935660208e4a2bf67d9cb055c0161e9d6ab541d5e373c0d24d91030a6a118037f38671dbf1b14b10dd091b8c4b1dfb9a1

  • SSDEEP

    768:G8m1Sq4NQErBsH1tzoisBKQI6dObAG/dq7uW29Ifnca/yyR+P2ujfGiCKPA+7XoJ:0sq+QV4rObAdCWpf/y+QozNwi6o1ZD

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2