Extracted

• • Target

    e98fb6fed466eb8a03193e708e79b509_JaffaCakes118

  • Size

    312KB

  • MD5

    e98fb6fed466eb8a03193e708e79b509

  • SHA1

    31db6748251e6d70ea26f426874d52a1c4ad00e4

  • SHA256

    f74bd56640cfe04f74e7d40c73a676e83fa4494ac956005133c6c429b36673b3

  • SHA512

    08083c633c2bf9f912d705e801441e0f1c4bcb9b28c0f4d437130fcdeab9a2aa3dab8f132029fed0ad95440c8f901f4d5fb6e7b8961b1292af279176ede230f0

  • SSDEEP

    6144:bFGeVNBpt+nTepIH0WuGcd13hnXc1zuty45pYts+oTMho:bFGcNB+Te+0WuDdBhM1yv56S+Y

  Score

  10^/10

  xtremeratpersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2