Extracted

• • Target

    JaffaCakes118_3ac9c8a6b9ed672c4d024029d19ed9a8

  • Size

    74KB

  • MD5

    3ac9c8a6b9ed672c4d024029d19ed9a8

  • SHA1

    a2ab5d7330a8ab85dbdcffaa2d5bb2d42e8a729d

  • SHA256

    4a3fe586b3806381665e4f400b937f68449583b8fc1c84cb68c5c1b59d29ce98

  • SHA512

    06b484752ff69238976e21f489a7345820a304da2b5c94ca0c6773bc538812c4dc5f1ac09f10398270cc842f9c6618ad587b7553a0f9d86e0aceafb99ed17f38

  • SSDEEP

    1536:mu3qrvUXdZEPSRdjDeUjiOb6boUtlEtIVK27juFqG0Tyi8KP41ARVodM:mu3q4CYdveO76boUtlEyH1RVv

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2