Extracted

• • Target

    b0d5c8abbaa4625087a2a43e00a6d47a_JaffaCakes118

  • Size

    122KB

  • MD5

    b0d5c8abbaa4625087a2a43e00a6d47a

  • SHA1

    c42adfb169b90be84add9387ba875ab5cbcf638d

  • SHA256

    d3bb9f49727406153a2aac4a0cab2a809f33b30eb86654b74754e398118718c1

  • SHA512

    44fda4b602621954ccd522f0f3df046869e8e49447ca13fe3ebc738635d713d3686fab6b68dd0719dacfbd158e3bb8a8b7f042632297e7ffedaa26eecc2eeb1c

  • SSDEEP

    3072:kCjAjjkir/I3l/hOhc6APDhOSnqt0YMcqxShc:XqR4yxAbgmUeS

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2