Extracted

• • Target

    JaffaCakes118_616eab44f50aa866fd0ef9a5b118ff44

  • Size

    131KB

  • MD5

    616eab44f50aa866fd0ef9a5b118ff44

  • SHA1

    9b2c5d7610fc0c84f0e2c803f3b2157f7a6860d1

  • SHA256

    4c083492999f81f02babbfca027d2b484f7bb4e432c2cf17824f42004c5bb50a

  • SHA512

    58382203a128997feda33207e20f43ff5582e22f641364f1292b4be298259df26c7f9e8052566bf5a70e41cf9bf245803efb76317028d60cd51814642fce43b4

  • SSDEEP

    3072:d83h69aSMFJ1z4G19SIzKrEIOfE7BQL43KyYm5gtp4ZxRJ:dIFxczrB5246g5gtp4Z

  Score

  10^/10

  xtremeratdiscoveryevasionpersistenceratspywaretrojanupx

  • Detect XtremeRAT payload

  • UAC bypass

    evasiontrojan

  • Windows security bypass

    evasiontrojan

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Maps connected drives based on registry

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2