Extracted

• • Target

    JaffaCakes118_2451c9fefcc13d30fe36983a266e7708

  • Size

    21KB

  • MD5

    2451c9fefcc13d30fe36983a266e7708

  • SHA1

    a99215e6455ed0067281092c8afe6ac5ce624b80

  • SHA256

    bfdf9a7c9d4ff72b7c9436842d703e590c2074a1704bc701aecdba0d07ff4b8c

  • SHA512

    46fa62a343f42f5f019444c430ef21c14622ae55505ed4c4b404751f7fdb1c7e4e07bac6c18e9d126ad8176e262dbb6d5e928fa46e22064f409874ec7101669f

  • SSDEEP

    384:r0IdmF+Ti213fEF9QZd/cBr5M/gOjkaS4s/1k5YiZNlfpQ4nb8Rvnl9uOpLR:wIsF81fG9QveLOYTe5Yi9pQQ8RJ

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2