Extracted

• • Target

    82515a842317ff8ee1c35812b0433634_JaffaCakes118

  • Size

    4.3MB

  • MD5

    82515a842317ff8ee1c35812b0433634

  • SHA1

    3ea612a37abd791f616d5fd39f2e2acfef64e24f

  • SHA256

    e74d8e70050e4b107cc18b363f9830c289fff64e60c6dd98e598c3096825645e

  • SHA512

    d940e7c9a812e30d3854b5084469d28baa351b451fe7c5b77915383772333eacdfa774d3711075712c9ad152caf7f1e678a57bad86f983d489301ac5aec9d0c2

  • SSDEEP

    98304:M++l/rWoxd5mBSqRxc60fhAMDubWhkYI+TOvQN:M3Soxd5wRxc6FAbqYI07N

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2