Extracted

• • Target

    51f233b146dd0a4e5b0f7b10b36564a4_JaffaCakes118

  • Size

    306KB

  • MD5

    51f233b146dd0a4e5b0f7b10b36564a4

  • SHA1

    65a46c9d479be9e96b211d5cef6dcf10d8efa165

  • SHA256

    b7c149c32f4a808072ad5d96506abb24ac8b9f483874a40ba36939865ecf8e42

  • SHA512

    c542a668732fc817bdeebbf636cacdf55240f81e0e2fead614e1e293e281870cfd56415382444efdd4ca4d1ee910bf4d1f9ea8e75e2925a2bc4dbdcb420ff218

  • SSDEEP

    6144:CcOkzRueZq/UAEb1Qlei+GQpuc4TyQOGoQbwyUx/F8pKMOqRPHY:ttudUAEb1Q7+GVpT0SuCtOq+

  Score

  10^/10

  xtremeratbootkitdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2