Extracted

• • Target

    JaffaCakes118_648c88970a951f1d11c2f59182a75a60

  • Size

    224KB

  • MD5

    648c88970a951f1d11c2f59182a75a60

  • SHA1

    d5e753b54d7037dc4bb4a1020152d77e121ddf07

  • SHA256

    d21c9b127f14bc7a5fdd4c4d1b5b907690bc422917b4545173583a4e6efcb1fa

  • SHA512

    2e9f6218eb1faa4fc374e29a4329dbc89ad1b6423d3151ce84c649da05730d60a2430e48bf74c50af2f2ceebcd8596ac17807aca2cc38b16711ec2432bb3e168

  • SSDEEP

    6144:XYZekOvhnqCrU/DIYXVNpGObuVzrBHv7Feypx:4ekO92IybyBskx

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2