Extracted

• • Target

    bb78fc2e4428fd2d6294c258b90dc6d4_JaffaCakes118

  • Size

    31KB

  • MD5

    bb78fc2e4428fd2d6294c258b90dc6d4

  • SHA1

    187e6150cb3eadc24bf8fec5a302b21a2b42a5b0

  • SHA256

    b28959bf7057d383edf738fe3a91aafd6d801b968a9f95d4ce9c6eb966be0ffd

  • SHA512

    35e0b0c8c8a2a9e15dccddb2e502fd792af82857f88ccbc4b10cf994094571e2f4911a27f6cc25de94178f2e3a270d361880ae2fb96412f0fdeae1404209fd40

  • SSDEEP

    768:rqX5npcxOhH6GzZSEjsLMIL/nriE7W5GTx6bPrxh:eX5nqOtlzcsnILO+W5PN

  Score

  10^/10

  xtremerataspackv2discoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2