Extracted

• • Target

    c045ae26208faa14c878ca4267bb73d0_JaffaCakes118

  • Size

    176KB

  • MD5

    c045ae26208faa14c878ca4267bb73d0

  • SHA1

    c8fb91d091cba7c93192f90aa8a030dfb959e0cf

  • SHA256

    79b9cb11c90f2c44968e729893934defb211171237edbf4fe13029a2144af669

  • SHA512

    ab57f72b6997da6fcd3ec7ac4c5f0b0b21dc1c9e25cd2eb9cce85afe8bdbfa025a43075ad16aa07be2dcf50d2d445e4b0b0a56a1bcf98b5f50b32ee574797284

  • SSDEEP

    1536:YuyguAiQ/cBJWumC7ZRtSjGN4IfGuJUHCHGwQrDIKluGeSnZQAPAlj:YufiQUShCrJa/VeSnZ1Uj

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2