Extracted

• • Target

    620f2d8bca853427bb6c0f485429a55c_JaffaCakes118

  • Size

    280KB

  • MD5

    620f2d8bca853427bb6c0f485429a55c

  • SHA1

    bb5fc905b4f6ac259275fbceedb30dd01b27bfa8

  • SHA256

    d53a02342e721936a83e562d88192584261d1ca040194eee486d86d6c7afe32a

  • SHA512

    d29764675320f9b18beb16bda3345ae54225736740eb7ee52d5c8274581fcc30fe562a93e0321cd96b7ef5e0c38ae87768125d5492e16e863ed10525b77a6d75

  • SSDEEP

    6144:HPS3bBHbP1pHq0IKZAWWkmR6iGfhv+C+e+GNLBRjAFNWk3dbGsK64:K3bBHbP1pKJWWkmrqv7+0N1RjAFcYtvY

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2