Extracted

• • Target

    789d5952652e56d6171b071c13bba199_JaffaCakes118

  • Size

    225KB

  • MD5

    789d5952652e56d6171b071c13bba199

  • SHA1

    330e2573a27760087bbcac36409180889495e2ec

  • SHA256

    34a74656884b96b38ac026c91ee11688653d1ccb3fb1eca65dedc285d6aaac6c

  • SHA512

    7c5e756ceda0dc8949eb8625064cfa3d0943652f3fae0279a717d132ff70fe03546141220a366cf70773b41e3922afff1425616bc9edb1e54b4fbf17b35a05c5

  • SSDEEP

    6144:eL51Vy/PAkYYO2W6v5GmiLElwR6PyPKYraBCDo8A9b:e91Y/PAkYYw7mqElwRTSYraB/

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2