Extracted

• • Target

    35ddf6436f8b57f36f926c5cf200e2c9_JaffaCakes118

  • Size

    607KB

  • MD5

    35ddf6436f8b57f36f926c5cf200e2c9

  • SHA1

    934310447cec525603f306008b168ff227fc9072

  • SHA256

    2781561cbaec7ac6b6f3c9e17b1f2dbb5ab96ae0d8a0d560c0c09e56bd0f1c19

  • SHA512

    7c86cab7dccfa5678c444f7cc8d30243910dc94888559b1ce7e6e9533b79675500ba9e2bb03ea7253583411dee2b73bc96fee02e02a038d7f4fc4976ad257db0

  • SSDEEP

    12288:dsz0aWhlk4x0t4B4ReoMgjJ2HI0K/lGRgOUqmq9kR6lhKX1ae/flS/rio:da0aKjdgjavK/cRgOnmq9g6M5/NS

  Score

  10^/10

  xtremeratpersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2