Extracted

• • Target

    JaffaCakes118_30fbf2d8457fa8f6c5aaf4ca1638de67

  • Size

    676KB

  • MD5

    30fbf2d8457fa8f6c5aaf4ca1638de67

  • SHA1

    6a867662c1866363a6684dae79405eec4689e3bb

  • SHA256

    1e8609d68cfcad35fceb9c6f89c3011e3e9dcf656fd0cd9a0c91f4e34cb4d191

  • SHA512

    cfbc6ba7daa8b433b4905eec57d257ea7b6db5519ec337aab634e2f2b2f3cf39478b92bb97543dadbf67326bbbf2a8da5eac33ed98fc12339715f9ed1f2c60b2

  • SSDEEP

    12288:VkymRGy8IPcPqeFDJBXTu6IgKKM4RVzYKj86sRk9n:miyUCMDzTupRgpYOak9n

  Score

  10^/10

  xtremeratbootkitdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2