Extracted

Extracted

• • Target

    92622b1a788b3a2b74faa3d2ee05f875_JaffaCakes118

  • Size

    236KB

  • MD5

    92622b1a788b3a2b74faa3d2ee05f875

  • SHA1

    353de63abe5144c234eb33e1742cb378e410383f

  • SHA256

    edd12d3f9354458a9a48daa684787afe56e606c940029de5b8b92020c70e2046

  • SHA512

    16418059cdeebc87c293c713562b6c8449719e7518a5c031f9cad6e4f5bc4c5b5a39d34cbcad6f88f0e05d3a6f83b8c5b046e2c86ff902367d06169cbb3c8523

  • SSDEEP

    6144:viNoKZCYHHarcq7lLdt3rFyUfG6/2GTVAeigntRgLfu:viVkS6rcq7lLbrFyU5/XAeigntR8u

  Score

  10^/10

  latentbotxtremeratdiscoverypersistenceratspywaretrojanupx

  • Detect XtremeRAT payload

  • LatentBot

    Modular trojan written in Delphi which has been in-the-wild since 2013.

    trojanlatentbot

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2