Extracted

• • Target

    68bb92d3fe51e12ce193736c6bf67f63_JaffaCakes118

  • Size

    427KB

  • MD5

    68bb92d3fe51e12ce193736c6bf67f63

  • SHA1

    9ce0e3996cf62137f8496ce2855ece5650c01bf1

  • SHA256

    b692872250de54d5968dba80bbaa83145a1a76f13b35801051559ebd5c7415fe

  • SHA512

    d1c7bbe85bd07138e98feea138a02c829cf62476e37b4aac479b3779fcc11d45f2002009e1d8b6908275af77a85d586802ce858d86e6998b5e14a9c11987ef49

  • SSDEEP

    12288:gzPBSAOu+ZAW6bKum6jADuGVtrEu+Vc2HywPpFpmKAae0d:g4u+ZAW8Pj6uEtrjkcyhdmKFek

  Score

  10^/10

  xtremeratdiscoverypersistenceratspyware

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2