Extracted

• • Target

    eaec6f2a04df1819f94b7072cf6f83bf_JaffaCakes118

  • Size

    72KB

  • MD5

    eaec6f2a04df1819f94b7072cf6f83bf

  • SHA1

    8ba805a93f6b791803060c1e9a62e3b3d2981605

  • SHA256

    967535359f7ab5e6947e19574677427f05db35039f04e4cc09104ac861cadfbb

  • SHA512

    8e9a6c5a90724337cb79ea85515864a8b17498bbf9a3a0f553d028c4e258c810dfa833e97c98c146239a1e1f1350b0210e341edee078485f75fa2966da09a6d0

  • SSDEEP

    768:nXE0VsdXWOWFweq/hQ4LjTJFpHxXOaZ2nS/zhbTw83zTCM51IVd4ddaTokBZdWuM:nXP8WO4nAZU83z+wIsdskKWuX9KB0

  Score

  10^/10

  xtremeratpersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Modifies Installed Components in the registry

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2