Extracted

• • Target

    JaffaCakes118_3e4cc3b38500d6159db52450da2285fc

  • Size

    132KB

  • MD5

    3e4cc3b38500d6159db52450da2285fc

  • SHA1

    f2f91c97b5cb0ebfcc777ee6d98eea7362fc8615

  • SHA256

    775dff37bf9b70daf6e2e795bcf8b1950f4d5bd1abb433ab0166fface1e0a587

  • SHA512

    7fabc6aedc7fe7871c20d66aad41ee115db65070422d5501d8ef9f1ae1cfd985c0ade622304a806680601ec4014c5ae945cb4567a8034b0700c0419d1885af54

  • SSDEEP

    1536:/Mn89MvS0RwnSQG+ifi0qtuFAqj2qFx0s45pTPWOFvnbAJycMO8zgWfM:lGvSazQG+ia0q0iK2qboPWoAVfWfM

  Score

  10^/10

  xtremeratbootkitdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2