Extracted

• • Target

    37b13059d29d1d237237c7e39994bd28_JaffaCakes118

  • Size

    301KB

  • MD5

    37b13059d29d1d237237c7e39994bd28

  • SHA1

    1ccebb230a943dbca2eda6d9ac3a83fa27b54bc4

  • SHA256

    3359ebdee5962621391361cf2bdc2906b410e79dfc34dd64ba9b1a10b0ef4b8f

  • SHA512

    1b6f8cf0a2a9008ee2021f32f85df638f27465e0c83e51d5238948eb75bdebc6695f6e64b66a2b9bf6fb3d95d69678249a86e64b98a2a3736c73dd6d973839df

  • SSDEEP

    768:Q8m1Sq4NQErBsH1tzoisBKQI6dObAG/dq8uW29Ifnca/yyR+P2ujfGiiXzoigXY8:Ssq+QV4rObAdXWpf/y+3oqodoox

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2