Extracted

• • Target
    4874a873c82ebaab0494ff93b128a174_JaffaCakes118
  • Size 148KB
  • SHA256 c5b4d46b5a176b27c852c75497eb39d6160734cef53b0b6af4732873b1c9ff7a
  • MD5 4874a873c82ebaab0494ff93b128a174
  • SHA1 e5766224dbcb24433f87a84646e91ae5666bc0bc
  • SHA512 bcf4e569ebf2423cc8f6e05f6eaee16147d7bdf7547f8a208ae440ab5f8d05380c5bfe2b46186ebbbd893023c1b1d2d2aff8c669d447e72de5d2b6cc6c84bb90
  • SSDEEP 3072:fJc4j4tMBfm1bUiTrZyZmTWF42wDThZgf6nH:6F2YGFwHhyf6n
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xtremeratpersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2