Extracted

• • Target

    JaffaCakes118_b21e16d26a741f0ebafdcb4773f4af10

  • Size

    747KB

  • MD5

    b21e16d26a741f0ebafdcb4773f4af10

  • SHA1

    2dccc61d0b5ed0f598596426fb9624963aab5727

  • SHA256

    2003b6788d0ae9f3dfa199d6b458683024935e561c922fa54f2a30a995b54755

  • SHA512

    58c96ee217a5afe313921b27685a068952600bbba76aaf05834d20f06e2540944094672f9055a4463041ae22e5f2cbcd7eedfee3b549faafb25e49d9f8bb7ace

  • SSDEEP

    12288:Y1j327fuuvuEPdPnP+hVdC2DBHgeas88MEqj4CFRA+LjTUf3rH3OvA:YEzuEVPnWhVdCyBAy88o4CN/y3LMA

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • Modifies WinLogon for persistence

    persistence

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1