Extracted

• • Target

    JaffaCakes118_6588a7a9e3a093ad3aca1ef4e6a98f57

  • Size

    120KB

  • MD5

    6588a7a9e3a093ad3aca1ef4e6a98f57

  • SHA1

    cc92af2646e35b171ce9afc935bf17a3d97884e9

  • SHA256

    05a056d68c535ba189cd722056f770a41300c599aec210020454d0b3c6d182d0

  • SHA512

    c23358f2cb261b7ea2b0c7dbf086297aa3777d5ea7ed2b11b2bad815ae4a34548d710a2ece01b894a5e54178bbf81dab73bcb788d3dead1bf9cf43d01cc9548e

  • SSDEEP

    768:k4Se+TO+LxSnUpzbVzjJeXPqKRZafehKNseSCl/m:kjVTZxSEVXMqsZa2wMsm

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • Modifies WinLogon for persistence

    persistence

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Adds policy Run key to start application

    persistence

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2