Extracted

• • Target
    1833558ee042699c879b6ac9ee02c3e2_JaffaCakes118
  • Size 148KB
  • SHA256 2aad03178c7e90f6c6d0264d57ea0981c26ff4713a2bb006cbee4b19ecb360f5
  • MD5 1833558ee042699c879b6ac9ee02c3e2
  • SHA1 a1d52cf46e587198b7c164b1663cd7bf24d2b5ef
  • SHA512 b21e7cc7858ad967b8a70e580645878d4deb441f2e805123c370622bcfa009d273fc891e5e472bd4c18a130af136538b6ca576fdee92bc0b90c51ffbe8a3dfdf
  • SSDEEP 3072:fJc4j4tMBfm1bUiTrZyZmTWF42wDThZgf6ndVs:6F2YGFwHhyf6nI
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xtremeratpersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2