Extracted

• • Target

    3be3a5ecc5085d8b7c8f0e7e978574cc_JaffaCakes118

  • Size

    108KB

  • MD5

    3be3a5ecc5085d8b7c8f0e7e978574cc

  • SHA1

    92c9b7d4bb2b4310761b992385a90c5b21226339

  • SHA256

    cf02bd4d854f02e43d3aa9ca48eb6c0e8f0602a9401f36be0007b7f0337a0c88

  • SHA512

    a3a4bf1eef86e7b12bde063340052bf939cfae07a22d87ffb172334697c8212d6862efa7cc0656bda35913407250295cc95290d41e459684f439d5d6399f8105

  • SSDEEP

    1536:dTWkx6kuL3cCDzAGqimFNLKMzRUsyDHMDSFgR75e6M1+nZtx2SVWoRTk:dSkx6XM0rqiYAF/sDSFgR1el1QtxMkT

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • Modifies WinLogon for persistence

    persistence

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2