Extracted

• • Target

    JaffaCakes118_6a7c374d73bb0748f8a30501495b2006

  • Size

    264KB

  • MD5

    6a7c374d73bb0748f8a30501495b2006

  • SHA1

    1a9992289bbf78dbda32f4ef862086a99790cd87

  • SHA256

    5d9e087b10701d5209e1cb00983bee1c08dc64be0c2681d97d217cbd3264fe11

  • SHA512

    7830202954d73573496130cb14e7e1d30a725e2699252456ad8d69a315cf02f16b241181c2b1ea8ef904873797aa3a17deb77add8de116cd4f17f872cda93583

  • SSDEEP

    6144:xjbeiirM3uZ/2Ud17dAf9hEa+a4gs4Pli+aWQqI0LjTWGBK:xu7MA281ZYyaNs4tTwQXNK

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Molebox Virtualization software

    Detects file using Molebox Virtualization software.

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2