Extracted

• • Target

    dc5362b9b39cf550b34c1272fe15b355_JaffaCakes118

  • Size

    269KB

  • MD5

    dc5362b9b39cf550b34c1272fe15b355

  • SHA1

    6c60bda81bd19686165f8c2070e6e8e1a32948d5

  • SHA256

    48cfbdeb4600dfd22582198b12d32538385f7a4f361281161892ff0ae2f9ccaf

  • SHA512

    f45ba811f2c9072d7b54ace3bbc26295d72ba10c639e3dcc9ef986761caad660933d0bba8c24fcc3c9fb7f67901ce284a38daec4d84249fe22bef6a23a29e0ff

  • SSDEEP

    3072:G/v7xIj0jsCpbqpu+IDzyyJRCvxe1ddRa53apZF8a4EvsagMGh0HDF++4B5hiSnu:MdJjrpRqrXaJ/15++shXhGTNKq8dR3Ra

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2