Extracted

• • Target

    JaffaCakes118_741927fc981f3cc1d356d447a8c5285f

  • Size

    44KB

  • MD5

    741927fc981f3cc1d356d447a8c5285f

  • SHA1

    b8c8760d6c85eb791a6666c0a1507f85d5ff8543

  • SHA256

    7317b1112de414b3e5862d938c50d4e4fcb84af3adbee7cbe3f4e05cc8292736

  • SHA512

    d0ab679cb419521f3caf8b67e693358c34103382d3af5bc0073338a0f901d8241f44e1b9f280a2d6fab5c3b1b547745e4a9eb955e2ef7f6e6206115bdb5e4b5f

  • SSDEEP

    768:IBr+tjFqTPkAlfztB1lr6an3smTA8uvm2DfOTwYPIvzoCJ:IyRUHlrL1lr6an3TLuvm2buQLoCJ

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2