Extracted

• • Target

    5f5405cf899443cf16a1a09f73d2d6d2_JaffaCakes118

  • Size

    50KB

  • MD5

    5f5405cf899443cf16a1a09f73d2d6d2

  • SHA1

    3a110fcc33f7897c5765c4fa7b280a914aca142b

  • SHA256

    d9204eb999e60c80de07b91aedb4b2c620ef435206eaad6113c5a3adf93ac7ac

  • SHA512

    16665606a7b02a4f88e4b6bcbfa20f68f5aecbb96f4da8891446b1226e1fde19d10df7b04c07aba45e72e6bc3df66e5e11fa997bb152ac0a7db3ec6be47fb22d

  • SSDEEP

    768:Fw3Ws7+7jpVj61ftgm8Xor0EEuoJ4wDyQzDWuegwYYExombyC48MWa3t2:FSWs78jc6m/quoaRweZYFxomW/vWY2

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2