Extracted

• • Target
    45fb4741695f822aa57c8a627e3c4644_JaffaCakes118
  • Size 69KB
  • SHA256 c6e18470596605fd228691c85793ac402606d7e61fb1461fff4530b9fb71fe99
  • MD5 45fb4741695f822aa57c8a627e3c4644
  • SHA1 e6beea41d1c378430f4a4ea40196242637304d34
  • SHA512 837af4024d958974d0ed42c05d135b281ccbca13e6a158a9ab965c7f32d1063153c928a2b7f25f236c5992fb36680bf0f53b8b84d8a0f60f724054510d4ab88d
  • SSDEEP 1536:UIsFw9veLJToUN5YH3617MYUQKEVzA7Yfij8OZwM1tAx:UtFw9Wr583cgOPW7PGotAx
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xtremeratpersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2