Extracted

• • Target

    JaffaCakes118_9c78b9c2f518aa8362363ec6c5ab916d

  • Size

    44KB

  • MD5

    9c78b9c2f518aa8362363ec6c5ab916d

  • SHA1

    4e3d9542bbb6235c05c35a2ec15a2eaef714c828

  • SHA256

    37db688bff7d5e47dd68c71e6e3e4096c781f17532332a0fa9428f54ff049b15

  • SHA512

    ffeb40efc34343ed1ae83215cdd174cfb95b04959086c759f7251b2846b586dae760e7b3c21a5921fe16a005e70de6d40e5a3458b57add5a6f85cd7bc0a3fab2

  • SSDEEP

    768:rBr+tjFqTPkAlfztB1lr6an3smT78uvm2DfOTwYPI0zouYJ:FyRUHlrL1lr6an3TAuvm2buQUouYJ

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2