Extracted

• • Target

    JaffaCakes118_418aba758db1af7b905d1e33b8eaa93b

  • Size

    115KB

  • MD5

    418aba758db1af7b905d1e33b8eaa93b

  • SHA1

    6e43044028fde1184f9b349d5b021cf2c8e0c455

  • SHA256

    834c55018e4c59f0873fca2aca61623ebf99c6e2ea7274a3e4d02b7077cbd814

  • SHA512

    07e6ddc74e6c055d4891b3851c9891f6a43f216e0068c958513e694db967078c95fe53bed47e5f6dbda5b25f3b3ee72e316d8d5f43db0a48561db43dd52cb5f9

  • SSDEEP

    1536:75CFBKEWUIr2QTkKFmWW7D6UzjgMEBKEWUIr2uCchqtPlBTviGGOJ:NCrK72RKsD6oSK72jtPGi

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2