Extracted

• • Target

    16ec8bb1f507bf012f895072c985057d_JaffaCakes118

  • Size

    69KB

  • MD5

    16ec8bb1f507bf012f895072c985057d

  • SHA1

    1e204b68340c9b60cdc4a3efb80a19962eaa888e

  • SHA256

    a7bc75059603106b4702ceebdb8701cf0a881c1cca1bff6398bbd6a2564e52d3

  • SHA512

    0062895c7e34c1cade1589601d5c7aae4c7d88631cd38beb6021ae5406c8169d34bb2c7ae16b6cf1ad954b4e19dd242bd37198900f541139ae2830c9d5734693

  • SSDEEP

    768:Kqgs5c77k+TLVOSW+gLa1pSSWYjNtI/7OYpu/lj3Yle7mW:l5c77d/4LaHjHI/7nMke7r

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Deletes itself

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2