Extracted

• • Target

    916bd1bf4bc489ea1fe45061d0f7210d_JaffaCakes118

  • Size

    668KB

  • MD5

    916bd1bf4bc489ea1fe45061d0f7210d

  • SHA1

    07768f49507099f013f989b4536635a655f57660

  • SHA256

    d81e62234e9763b36a8f4acac3d8f4f2061d6140d1775ddd55164b4e8197be59

  • SHA512

    00f72fbb46396395b2a34790728ba23ad556e1353fa8934e42dd2212d992f5343fa65d122b672c0e728c3e2a3e6bb21fc35577d74840656c698fd3266db50e2d

  • SSDEEP

    12288:POqBSJNJ/+EkGz1lr3nxGteN4r3t8UOGz624SitfLmygYiW:2CScE7z193Rit8UJ62BmhgLW

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops desktop.ini file(s)

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2