Extracted

• • Target

    2fa05d278879f7fd391fe1cf304e4b33_JaffaCakes118

  • Size

    469KB

  • MD5

    2fa05d278879f7fd391fe1cf304e4b33

  • SHA1

    9e97c7c1650c8e04c1367625b66ef64c74d21ab3

  • SHA256

    fab9da70d7122fa82a4caa98ccb298e371f01067f5c3be95f8860c3e7fd5f209

  • SHA512

    f5b9b61ec1105ee4d2f2380672d46edd7b53df56c33327239b1341bf50f7feeb6197f14c16e29b53440d2262aaf0c28f897f90a7f7b8e26d30a701062bcc849b

  • SSDEEP

    12288:P2jy4H/JlI91veibKY5q2apD7RYfiuPLYBNMUe19s8+97e5Zg:P2m4R+fFp5PapSausBNHi9bng

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • ACProtect 1.3x - 1.4x DLL software

    Detects file using ACProtect software.

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2