Extracted

• • Target

    JaffaCakes118_e44b72e87381ad7ad65cc98f1ac771ec

  • Size

    676KB

  • MD5

    e44b72e87381ad7ad65cc98f1ac771ec

  • SHA1

    7c366af2721b2662550608e31ccf5804fdde6b37

  • SHA256

    16e73f4b913dc810a9db63d40cfca336da06c1eca25ffd832949888b98ee0320

  • SHA512

    89e56895fc6fcd022c4138db965fb1f1c5e69e3e6cfb7717aeb3a73be036961c9df36389b4792938fe9afb98edaa35216c150ece10baaea140aaf301af7cdb8b

  • SSDEEP

    12288:VBXsJa8W5HG0o08X0359II8MOm2Hq1QvFlK/lGRgOUqmq9kR6lhKXqDxQBmSxXAb:VBcW5Hk0DtEq1Q3K/cRgOnmq9g6bV6m9

  Score

  10^/10

  xtremeratdiscoverypersistenceratspywareupx

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2