Extracted

• • Target

    6136829c70d5b6c6418064dce6fff164_JaffaCakes118

  • Size

    261KB

  • MD5

    6136829c70d5b6c6418064dce6fff164

  • SHA1

    af759ed75a3db6611c9d9dde3871fbcaea8f969f

  • SHA256

    a99990347c3e6eb8a15b047ab9042f19886e7db8058a2b84c2e56af38598dc35

  • SHA512

    ff80d0162596f322a7b31b19a3302d59216d03c73d6fcb0b3d7901b97fee4b329e56c4457d93a48d85d4da21d67e56bdd370cfe28376ca974657c280be5b73a8

  • SSDEEP

    6144:eMqPhsvTkou98LwvP6bQ7yMP+DE827fVdoj:eMqP8Tw6b7MP+Dd27VKj

  Score

  10^/10

  xtremeratbootkitdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2