Extracted

• • Target

    JaffaCakes118_982d7a0d9f3d9e6e7780d33257975ddc

  • Size

    404KB

  • MD5

    982d7a0d9f3d9e6e7780d33257975ddc

  • SHA1

    3cff42ac645492a5c6f5787d76ff657205c4281d

  • SHA256

    5c76abec68896a7befcdf1b99cc80b01e19a6a3b8da3c61ed975ff546d4d12db

  • SHA512

    18952a296c26901bc147c1fc2e657f67d85e3f4307110d26517c3e6fe2782264f4d1a6c2a0856fc16ff24ad52b77480a4c58ed6c29898ac02fa15121e48015a8

  • SSDEEP

    12288:P19Nk9NHoWb2D6dIEGpzK6FSkFvsAeF0CxYgdb2:N9Nk9NvY6i5pzv9enYE2

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2