Extracted

Extracted

• • Target
    11b7a55cd4b071e05e171c46bd02c0c5_JaffaCakes118
  • Size 176KB
  • SHA256 96524963e1015f6163bbc7cb0615bd26e782e0277a30478944afd6ff610a1cbb
  • MD5 11b7a55cd4b071e05e171c46bd02c0c5
  • SHA1 4dba388277150ef164a28fe68eb36f7fce64b6d1
  • SHA512 04dadda54ee51ab5242df8783186d07c9c4b30c61f122720701b175fba8192c18c76dd6c5ac5d0cdacd0844c9390ff49427da179eb2dcc0563dbc981881ed079
  • SSDEEP 3072:AT8S/S2x2WG6cOVj7GkvT5iU8TWJjFcV58y0gsQfuJjvdady5hCu3V2/r7m:yKS2ecOVnGkbEUI8yhyjh/k
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  salityxtremerataspackv2backdoorevasionpersistenceratspywaretrojanupx

  • Detect XtremeRAT payload

  • Modifies firewall policy service

    evasion

  • Sality

    Sality is backdoor written in C++, first discovered in 2003.

    backdoorsality

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • ASPack v2.12-2.42

    Detects executables packed with ASPack v2.12-2.42

    aspackv2

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of SetThreadContext

  behavioral1behavioral2