Extracted

• • Target

    a3db2c6f5f7c678f5759cc53625c9b1f_JaffaCakes118

  • Size

    59KB

  • MD5

    a3db2c6f5f7c678f5759cc53625c9b1f

  • SHA1

    a5414b1b37bdd4792be870a1512fdf1718fd6616

  • SHA256

    680acb227dfac6549414c55d596df2a0058c4fdb7613b15a27e7d815a033dd9f

  • SHA512

    9540c05e764b30456693338a03cf776b15d83440862741dada2df45cb35cc4eef66636075e0dff2a1da829ecc9bc1d4ba793f1ea6370849ba1ef39790aef7336

  • SSDEEP

    1536:t/ozcLd17wHwUJEvYoNu8bEYvYmU+8H6wDxxd42:Voy9wREw+u84YvYmUxH3T

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2