Extracted

• • Target

    JaffaCakes118_78eb8e5963914f564140c75bb030cdd0

  • Size

    668KB

  • MD5

    78eb8e5963914f564140c75bb030cdd0

  • SHA1

    cd53c928dd332bb40fdef34287c4239eff468a4a

  • SHA256

    0f1f093ac8ac55db7f3d28310ab2b9b92aed9431cfa09ab18d0b0e31f6505815

  • SHA512

    c374efe1e2dc1350649e445fd335a667bf29ffe7a7ad2672eb04e995bee8c763dea81360113e1e55275f4c40a59d956d4677939161bc5c7cadb2a91cb152b2a9

  • SSDEEP

    12288:POqBSJNJ/+EkGz1lr3nxGteN4r3t8UOGz624SitfLmygYp0:2CScE7z193Rit8UJ62Bmhgo0

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2