Extracted

• • Target

    JaffaCakes118_deeb2500038e367d8a4baa0ba5b6cdc3

  • Size

    683KB

  • MD5

    deeb2500038e367d8a4baa0ba5b6cdc3

  • SHA1

    6850d425a44bbb770800e1e167daad441a4d229b

  • SHA256

    3f6cdddacc5ad8f48bf9afdf228cd7058500f653cbf3466f66e9fca02222d5cc

  • SHA512

    ce69c9b00dd0c77e950466addc1fa17ce65645b099c486e2aa354c5b503b889d5016bacefb4d7d57af725d39e50d0928cbf396f95f989b57808dc1bcd6fed85f

  • SSDEEP

    12288:Mutrzh9xOXki5l1V2SrwDE8b09uDdLqCNQruBLiqawOLB2fm4Yi5Zpi+ZmLbyMvq:Mutr5OUi5l1V26uA9e8CN0KLiveYuZpX

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  behavioral1behavioral2