Extracted

• • Target

    JaffaCakes118_4367880a707b638518519d649bee956d

  • Size

    205KB

  • MD5

    4367880a707b638518519d649bee956d

  • SHA1

    c02ecf3dd6c776f30ef523f1ec342779c484a55d

  • SHA256

    bd6af06b0b0cfd7f2e3cacd34b61380511c24e2669a4423cdce65fc33fc8cd0a

  • SHA512

    a94826529456963acabcc2c0c2ba8175e689166f7bc68febcefc41279158fc2be15b918b363599b6f3f94f304013c0727b3ea5af95c557c8c3cd1f685d14bd8c

  • SSDEEP

    3072:7wYDa+LDdS5f39vDTgWTrHmyvVxKUiOpPPjlavX02U2dyyLWAHf3:7bDzk5pRHfntjb2U2dyKf

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2