Extracted

• • Target

    JaffaCakes118_7fd3f444a5ea679395fcc4ca71744b04

  • Size

    21KB

  • MD5

    7fd3f444a5ea679395fcc4ca71744b04

  • SHA1

    ad923cb5b96ee43146472d6233dd73a0dc082f9d

  • SHA256

    49744246575a38fd9ac4786988daab6567a30dcc2b703b3a5bb396dd0c244a99

  • SHA512

    cc1ed6a46d65360a75ebe6411991ab14a3c3878d5ce1e8a2774b13e7674bd62f452e7b0fc2e7c8cfe0bb8a90b9e940556102eb171f7540b890d8ccf822ff2a91

  • SSDEEP

    384:5IdmF+Ti213fEF9QZd/cBr5M/gOjkaS4s/1k5YiZNlKhpQ4huCd4O+pLR:5IsF81fG9QveLOYTe5YiApQoHS

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2