Extracted

• • Target

    JaffaCakes118_625fdb234249d2d0648ae103dbf2c6c9

  • Size

    490KB

  • MD5

    625fdb234249d2d0648ae103dbf2c6c9

  • SHA1

    ff8cc3c372f6e4e0afc1731052c83029d6d2fdbc

  • SHA256

    11e7ec53dddc90f8c0e376f707a083a0cb5ea9d6502fe7757dd6fed8e57928c9

  • SHA512

    3ff56af4aed49fb84fbad6d6b4bf5a33e974524510e510a1230669c5403656e36e62c2c692a62498bc880f744b414faa65b74043d28c87aceeef312ae1ac2933

  • SSDEEP

    12288:05ANhhgCHSJqMOaCooTuBTQT6LSCQDMizxYTU1LCZQLS:05+1H3/I9Q/CQwO+TILCmLS

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2