Extracted

• • Target

    87e378011e0391563b7a00817bd0672f_JaffaCakes118

  • Size

    812KB

  • MD5

    87e378011e0391563b7a00817bd0672f

  • SHA1

    20550443e185183d46dd73221a27abb324daf951

  • SHA256

    b5d100d2e0885d0bf83a2bbda3b85eff31cadb0a4ddf2c29f912c4b2573744e4

  • SHA512

    2abb0ad9e76f019e44d4d130e5e524d01dcef9401da692599d428287a064e019febd72a398c205d3cb8d3fa8e8f595440c9e62de63ff953b8d989aa2719dcc62

  • SSDEEP

    6144:wRM77dMCZIwci+LwOEKCt/7avzhYn6kCf2iq/NY:wRM7dM7ZC/7gdYn6kri

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2