Extracted

• • Target

    JaffaCakes118_a0759960cfb1be11dc3bfdd1aef7c772

  • Size

    222KB

  • MD5

    a0759960cfb1be11dc3bfdd1aef7c772

  • SHA1

    0443b28d4e679e4eddf8ea8a77ee1b4fe3b2da5a

  • SHA256

    01a4c44b7b84f0982518a55833030144fb0c6a929078d30e773e1fb6cf07841f

  • SHA512

    18a8915b1839e6656db70afb417469fd575fa9536f8ce8f9d1e2a502d04311b06992cd56623b0b320d52ad13ba827009bb8982b99e96bcc5a23561f08a8d786b

  • SSDEEP

    3072:yykOu7aKjyzBr8y4wqXDOmfx0RuWnK/Z8RM4WxyWHjSLv4es7JGsaB+tnTZExjGp:yyrz2y4VDOezSRMdi7crfTOGLPo8

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1