Extracted

• • Target

    JaffaCakes118_06c19d75fb6bdbadb8c6b7dd81705524

  • Size

    63KB

  • MD5

    06c19d75fb6bdbadb8c6b7dd81705524

  • SHA1

    976dac0eb9a014388089697073d1e5f123511230

  • SHA256

    c160844694476e03be2bc9491b6dc994b952739f05ecf57352f91af3c3fa4f71

  • SHA512

    f96d34abdf373f518e96417a80b53d52f7540040e10ea13889066e517faa63d36b167ef88e531845aed1452678820d5154e5caa77c379f83ee7953a9fe36ac26

  • SSDEEP

    1536:ZGGLXyYF0CCPzNbuBqTRAyQ0k68IEcHKNFit:ZGayYF0jLJVNHmLIhqNi

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2