Extracted

• • Target

    2a630875dba12649bba9c75b14b22ec8_JaffaCakes118

  • Size

    348KB

  • MD5

    2a630875dba12649bba9c75b14b22ec8

  • SHA1

    d021ef443bee4a7c84baf123692f820fa8f4f7e1

  • SHA256

    555ef2d263e0a0b6455d2aa88892fb24248dcd3b04db1de2f0a2fa3d616f2e07

  • SHA512

    9d67e9032b494b9587cd8211dbd058729abb05017e52dfd1117f4a4d027890a2108b56e31928ee8372c45a079b120b1e4d8fc4d8c5bcda4be1577ac333a284f5

  • SSDEEP

    6144:WLPXVSPapJNHJrmoq7tPW7spHWtksBTgtQEgO2qNEKwSd+3/twI8s6r:kXVSjPW7C2aATg9gUNlF+31j8Hr

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2