Extracted

• • Target

    bcc52e1ddddd2061619fc15fa79e1f5f_JaffaCakes118

  • Size

    732KB

  • MD5

    bcc52e1ddddd2061619fc15fa79e1f5f

  • SHA1

    7845ca92d3bdeabd7bfe8acbd3b984fe71e3ec34

  • SHA256

    a8591b5376dd7a4fa96a43bdde1d4f28342e7fc31a5c3eea764d70e7a8aeb295

  • SHA512

    1ecf4a0fa6dc39a75edc826dfd6c386049bbe78b8330f5dca6d15b50ff5a10bbd265dbaca72e771fbc44b412a4cebb1f12cbb39ff484aa804628060332834217

  • SSDEEP

    12288:C1gNVafk/XGZC0bs0vFutYyUvwM4VN+RBWN:CiCs/XS1cSyUM+R

  Score

  10^/10

  xtremeratpersistenceratspywareupx

  • Detect XtremeRAT payload

  • Modifies WinLogon for persistence

    persistence

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2