Extracted

• • Target

    JaffaCakes118_88bdbcaac918aecc7d234869c72ad4cd

  • Size

    223KB

  • MD5

    88bdbcaac918aecc7d234869c72ad4cd

  • SHA1

    32ec06a262002d09df0c4572818885215fc91f16

  • SHA256

    27af0279ea91d157ec2fc9d0b5f1d5794a1c60656192d94cb19c578a40718175

  • SHA512

    06ef922bcc544d50c41aa98c684860736dc08378c8cec7b8b81315354c01d0867e4c1e442e9f30c8b71339a58b86c5fbd010cbedc04c01ebbd4083f5dfd255a4

  • SSDEEP

    6144:RYZe7PheEH+UEuQTs+NLIj13/zQ2I56EvcZnjbTo6:ie7PhIUXcn813bc56Eoo6

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Molebox Virtualization software

    Detects file using Molebox Virtualization software.

  • Adds Run key to start application

    persistence
  behavioral1behavioral2