Extracted

• • Target

    JaffaCakes118_63b1f64f8aa21c54be0d2bc80251847b

  • Size

    672KB

  • MD5

    63b1f64f8aa21c54be0d2bc80251847b

  • SHA1

    5c9df3ef0036c5ad4b92bb357504bf0dd562d2cc

  • SHA256

    c777148f3880e261e1ec9ff5e174e5fd22b4f4f2aae5a459ff20e1344e785989

  • SHA512

    db7d8c2055eef2039e56a450193310dea15e72e92114aab325879b67a93e372c9c1f5c4ac0a874dad35897f06fa1bed2c2cffeb3b095a4f39e887f2295487661

  • SSDEEP

    1536:ukHBh/zwwgYYejIe1Gjsf8Na48u6Nu3SgNGmlS5Dgw/eoQ:NBkjs0Na4JSgNGmlS5DlM

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2