Extracted

• • Target

    7e085a5aa4dbf98cf74de0b7422b5341_JaffaCakes118

  • Size

    150KB

  • MD5

    7e085a5aa4dbf98cf74de0b7422b5341

  • SHA1

    6d4f72a95d74f563f937ea2d7ee7f96b1b62aa47

  • SHA256

    fc0e677692827ffe68f75f8941146351686f9ff82144afc174cf2798eb666f4a

  • SHA512

    13221c1da45037eef8692f9ea89ad485417a2e5e63853a8b34f19b7c006a6691a46909d3e84fca697fdb82978119728690977ea1adb1689c97cd2ef6748218e2

  • SSDEEP

    3072:qlu0ckOZKNq2z1VF16e2eYPbuRLL+hyLbhOpCY:GutBKw2VCbRbELL+

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2