Extracted

• • Target

    JaffaCakes118_79969c55aa2e0acb8e6790c476d306a9

  • Size

    578KB

  • MD5

    79969c55aa2e0acb8e6790c476d306a9

  • SHA1

    9eb1a2bb0d896e1c7d1e80941a9811e759a83187

  • SHA256

    588187edb6184605c26fa58cf8a02b53f2d1bf79b2f8f8eaf1704a1c1c6dde18

  • SHA512

    8f81abcd5cbe55cbd96eb2f0968c29d76886e86f98968d56716ce9509d6fa478dcd5284dcea0162ed4f65e150714438347713721fad54cf6f500c90df63f225a

  • SSDEEP

    12288:/4F09/ir9yLXiSLK4trqE8ccH0rg017oz8t6Ico6Ic7:A09/ceHLK3EyU117FcGc7

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2