Extracted

• • Target

    673cba7b91b43866a8e63bccb4163df2_JaffaCakes118

  • Size

    125KB

  • MD5

    673cba7b91b43866a8e63bccb4163df2

  • SHA1

    78829d73bf718b98829a780fae4079123fa10003

  • SHA256

    bffaaa5f1a96f135524630d67c944bf297e81009e45a26aea5ce6ce8db896de6

  • SHA512

    a709ef8d3b54c7f605de11dd5e4b7f6a7b71c848645f7aac162a69b77bd8575506643f36a6ffd1cbac066963c594cdd5cc1df790e4876faf676e8d777318d879

  • SSDEEP

    3072:FGNW7dEvotvXjz1brx4Dn6J7VYvDhCHR05sJ+gtN5:FGNW7mvIfRWnpLha05s5X

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupxevasion

  • Detect XtremeRAT payload

  • Modifies firewall policy service

    evasion

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2