Extracted

• • Target

    JaffaCakes118_88d10615ac65b2bb2b288b1329bf4009

  • Size

    21KB

  • MD5

    88d10615ac65b2bb2b288b1329bf4009

  • SHA1

    408e3f615c8285235fb8b792e7d2807b3fd041ca

  • SHA256

    9a263e97443c75cda48e47b6ce96417d54035ae1c7f530c883552d077bc645ac

  • SHA512

    d8a593b569386b2ca02a78783a82af787998c4e529ad849e4ff1acf5028661ee58911eb37fdc9e2a58a151d16845bc5a7c1604fe34fc8f326f5888e0ad582b86

  • SSDEEP

    384:rcIdmF+Ti213fEF9QZd/cBr5M/gOjkaS4s/1k5YiZNlfjZQybjY1I98dpLR:gIsF81fG9QveLOYTe5YitZNjY1m8h

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2