Extracted

• • Target

    JaffaCakes118_0201068d419420a99c289f33877a243f

  • Size

    830KB

  • MD5

    0201068d419420a99c289f33877a243f

  • SHA1

    a2e32a2e97652728ab2add67f3f407ed79bffd7b

  • SHA256

    8404c0bbedfd037d0a9587ae53e14610451dcf3dd8aaad0319347018a736bfd1

  • SHA512

    9e9b316238d379b63e92f38d820a4c6f86f324400b189f5684a814a59a5bbf6bcd23e2f4fe6f921818ae9fbedf522fb72c02369d4d7f75ff66d6a400138a2458

  • SSDEEP

    12288:v0sGCE4zBreayZpL3LaMv89OWOLVVF3B4oLPmolWNotd4/TAU/xoqLPay1odbm5n:RGsBrYZ5r5VT+ogHNfLPjQbm5Xaz0Ld

  Score

  10^/10

  xtremeratbootkitdefense_evasiondiscoverypersistenceratspywaretrojan

  • Detect XtremeRAT payload

  • XtremeRAT

    The XtremeRAT was developed by xtremecoder and has been available since at least 2010, and written in Delphi.

    persistencespywareratxtremerat

  • Xtremerat family

    xtremerat

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks whether UAC is enabled

    defense_evasiontrojan

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2