Extracted

• • Target

    JaffaCakes118_cda078a5cad585a8c65722cb893499a2

  • Size

    295KB

  • MD5

    cda078a5cad585a8c65722cb893499a2

  • SHA1

    1994003676c0360b6e98de17038b4f86d12f314b

  • SHA256

    11d0a2ca052ba63b04576d49bd2150bf09159f6c037ae8f53f365e0172c93d6d

  • SHA512

    94e7e69445e68d0bc03a7fac9a19b687161ef974ec881b454674998c9d9f070a97f02633c28414460417cdd396640d58c31a0466ffaadec0cfb54d837cff2c49

  • SSDEEP

    6144:UaUdZWjtJAqqULirzVqpvZoV+XjQ4EbnVW5GJZ2tNYLj8MfsaeWJ:UVdZWjtmroZuV+kVzYKj86saFJ

  Score

  10^/10

  xtremeratbootkitdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2