Extracted

• • Target

    JaffaCakes118_f0e35d7526ac18475f1cfcdd6c772a8c

  • Size

    211KB

  • MD5

    f0e35d7526ac18475f1cfcdd6c772a8c

  • SHA1

    525a6d099216ae252d803f0e47806a55621e6d9e

  • SHA256

    b9021561415bff1468c140ce32431baf1ee6f94aeacf450634f2b76232055438

  • SHA512

    923ccad09ede28890165792c9229076ba55683efb989da85dea14048abed45abd8ca40af77d4a086f5701daabbcc6da415e0c737bb98029dfcf411b2a0c3ab0a

  • SSDEEP

    6144:dqZ7oEYoRAQaUbRZH+CHRSwI7PTn422b4HuwIAXbPZcry+wNKevSK0b4EeU:da7TFUUbRMCf

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • Modifies WinLogon for persistence

    persistence

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2