Extracted

• • Target

    JaffaCakes118_925ab685956e7f42173c2200d2b25397

  • Size

    144KB

  • MD5

    925ab685956e7f42173c2200d2b25397

  • SHA1

    098b8a082f9733848ea4bf5c8a39ab2d6a5b0bc8

  • SHA256

    789cfb02916c709c9577baf9b846ede556ad07f29b3c3818b1c9f30bd26e870e

  • SHA512

    9fb75d495c96947f5cfad85ebac61bc8dd37d7f6dafd058170a675b4cf340e776b694692d6a0e5a68fbb06934871e803b6df344127f9b6add82808df29a90b44

  • SSDEEP

    3072:88807IRJ5b+j/Bws9U1cQCGb6LKyzEIMmDX5Afo8COj:8LV+j/moPXf2FIMmzK

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2