Extracted

• • Target

    a4cddb4d05923df30ff0794d478769b2_JaffaCakes118

  • Size

    885KB

  • MD5

    a4cddb4d05923df30ff0794d478769b2

  • SHA1

    84d18e438a933601604055eb5aef4b492b9b6b33

  • SHA256

    444019851d9dff176ff5a031d0c64eb491b37ae2cd84bf3214474121851f377a

  • SHA512

    77dce82bcbd69e4aeb88b6bbc65825d021decf95799bee7807d392a46f6a58c1e3e7168e99d38e9c86f32e771ea07ce894ed50165bc68d09f1447b5050f1b914

  • SSDEEP

    24576:C5bfVHXcEjg9244W8N5Gp5KFbjDl75hmV1UMP9n+eh:CVtHX9f4UFHDZ5AVug9n+G

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2