Extracted

• • Target

    374fa850ec0b4f4c425d0544d52f3fcc_JaffaCakes118

  • Size

    219KB

  • MD5

    374fa850ec0b4f4c425d0544d52f3fcc

  • SHA1

    593de340eb356bf564eff218fc48ff35744a0355

  • SHA256

    86fa4c9bbefb42f29d662202c1ca10130f39d1ecbe5031bdee1f738e23f5a40e

  • SHA512

    079d83b01526762d54ed7ca47a2bb2c93bb6381ef4f4750c5d58fbd07cbfb36ac9775cdc31087930eba1b994f6ed44d372ed0ad617d114c3780b82e92a34bd74

  • SSDEEP

    3072:27ZNI+FjNTjuO8zYkS6P+pmjVItNz/jO71r06JvJiPn29K+55HSk99XJcTphigTJ:2F2MjNWspjmHSk+AF7jmAa

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2