Extracted

• • Target

    91e17c1642d3098b745c5dc4bc204a81_JaffaCakes118

  • Size

    504KB

  • MD5

    91e17c1642d3098b745c5dc4bc204a81

  • SHA1

    a9d18083d87263b1cc437023a912f84b64d98b2a

  • SHA256

    9a30b4cb52dc8718605fe1083f6fa2fbe7f9fd00f152f18beeb3ca71394aee2c

  • SHA512

    e1a8eb55da59fc7506d73dbe22cf0e40eb9b5968118e28ea56c0cd2db0582e9bd7e09e1c408fdf7a2b5fc8f710d7c4152dd7db701f7c9c997f4b33b9cda630d5

  • SSDEEP

    12288:iYor7uazcS1dnudR8ng5cbprWdz5YDUK6Tv8pWF:jor7uazhcGPbZWdz5YABG

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2