Extracted

• • Target

    c2531127a3a652699f9b3d4b4215f019_JaffaCakes118

  • Size

    103KB

  • MD5

    c2531127a3a652699f9b3d4b4215f019

  • SHA1

    2c67f58515dc3b2d4fed610e55ee78d26ada84be

  • SHA256

    9fb590a2bd7a2c93aa9be7fd617c5c67cdd66eebcaebc44677d04b98028929c6

  • SHA512

    e4ef76917863f2e94441bc00a4d48b049566e7b4afa78e45226f05b0d472c388add90366eb7c60ef75676696da21e5f95bd8ad698a835ec7b568fdc2326bd373

  • SSDEEP

    1536:0OghaZcYZqJC3xdTNYs9dhoh8SHsNqJH2xEXXxg7/sU1pf6urX:0PaZ0JKSs3hPSMNr8+DV

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2